A three-dimensional point cloud backdoor attack method based on multi-scale collaborative disturbance
Patent Information
- Application Number
- CN202610991698.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-03
- Publication Date
- 2026-10-13
AI Technical Summary
然而，这些模型高度依赖大规模外部数据和复杂训练流程，一旦训练阶段被恶意篡改，隐藏在数据中的后门触发器即可在推理时诱导模型做出错误决策，对实际系统安全造成严重威胁
[0058]本发明的有益效果如下：本发明提出了一种基于SP评分的区域选择机制，其以策略性方式确定触发器的最佳嵌入位置，从而同步提升攻击性能和隐蔽性；另外本发明构建了一种新颖的多尺度协同扰动框架，将可学习局部语义触发器与可学习全局扰动有效融合，在多空间尺度协同施加扰动，可以显著增强触发器的自适应性、攻击性能以及隐蔽性。
Smart Images
Figure CN122903978A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a backdoor attack method for three-dimensional point clouds based on multi-scale collaborative perturbation, belonging to the fields of three-dimensional point cloud processing and information security technology. Background Technology
[0002] 3D point clouds can accurately reconstruct the spatial geometric features of objects, and have become a core data carrier for safety-critical applications such as autonomous driving, robot perception, and digital twins. With the widespread adoption of LiDAR and depth cameras, massive amounts of point cloud data continue to emerge, driving significant breakthroughs in classification, detection, and segmentation tasks for deep networks such as PointNet, PointNet++, and DGCNN. However, these models heavily rely on large-scale external data and complex training processes. If malicious tampering occurs during the training phase, backdoor triggers hidden within the data can induce incorrect decisions during inference, posing a serious threat to the security of real-world systems.
[0003] Existing point cloud backdoor attack strategies mainly fall into two categories: one is to implant fixed triggers in local areas. Although the geometric changes are minor and the concealment is good, the trigger signals are limited, making it difficult to maintain a stable and efficient misclassification rate; the other is to apply large random perturbations to the entire point cloud. Although this can enhance the trigger signals, it significantly destroys visual similarity and is easily detected by preprocessing such as curvature filtering and saliency map analysis, or by the human eye. In addition, these methods often inject triggers at random or preset locations, lacking joint consideration of model sensitivity and geometric perceptibility, resulting in poor cross-scene generalization ability and insufficient robustness to mainstream defense measures.
[0004] To address the aforementioned shortcomings, there is an urgent need for a multi-scale backdoor attack scheme that can accurately locate and efficiently embed the region, and achieve the combined effect of strong local signals and weak global perturbations. This would simultaneously improve the visual concealment of poisoned point clouds and the model's misclassification success rate, providing a more challenging benchmark for the security assessment and adversarial testing of 3D deep learning models. Summary of the Invention
[0005] The technical problem to be solved by this invention is to overcome the shortcomings of existing 3D point cloud backdoor attacks and provide a 3D point cloud backdoor attack method based on multi-scale cooperative perturbation.
[0006] The technical solution adopted to solve the above technical problems is: a three-dimensional point cloud backdoor attack method based on multi-scale cooperative perturbation, which is deployed in a multi-class classification task based on three-dimensional point clouds, the task including a three-dimensional deep neural network classifier and several three-dimensional point cloud samples.
[0007] Its three-dimensional deep neural network classifier is represented as:
[0008]
[0009] Each sample Composed of N three-dimensional coordinate points The clean dataset is composed of data whose corresponding true labels are y∈{1,...,K}. The expression for the clean dataset is as follows:
[0010]
[0011] In standard supervised learning, the model is trained on a clean dataset by minimizing the cross-entropy loss function, and its optimization objective can be expressed as:
[0012]
[0013] in Let τ represent the cross-entropy loss function. However, backdoor attacks require an additional objective during the training phase: injecting malicious triggers into clean samples. This allows the model to maintain high accuracy when processing clean samples, but will classify any sample carrying a backdoor trigger as the attacker-specified target label t. Specifically, the attacker needs to construct the trigger generation function τ. ω (.), converts clean sample X into a poisoned sample. It is represented as:
[0014]
[0015] The backdoor model was trained using both clean and poisoned samples. The trigger parameters ω contain both local semantic trigger-related parameters and global perturbation-related parameters, which are then injected point-to-point into clean samples X.
[0016] The attacker requests the triggering of a backdoor model. Two key properties must be satisfied simultaneously: First, in all clean samples... Guarantee First, maintain cleanliness and accuracy; second, for all poisoned samples. Must be satisfied with a high probability This achieves targeted misclassification. To do this, the attacker replaces a subset of samples in the training set with poisoned samples carrying triggers and relabels them with the attacker-specified target label t, forming a poisoned subset. During the training phase, the model receives both clean and poisoned samples for training, and its optimization objective is uniformly represented as:
[0017]
[0018] in Clean samples in the backdoor model The classification loss on the data can be expressed as:
[0019]
[0020] The poisoned sample is in the backdoor model The backdoor loss can be expressed as:
[0021]
[0022] To constrain imperceptibility, a typical approach is to minimize the L2 distance or Chamfer distance between clean and poisoned samples, which can be expressed as:
[0023]
[0024] Where d(·,·) can be the mean square distance, Chamfer distance, or other shape similarity metrics. To constrain surface smoothness and local curvature changes, and to prevent significant geometric artifacts after trigger implantation, it can be represented as:
[0025]
[0026] in and This represents the curvature estimate of point x before and after triggering.
[0027] In the three-dimensional point cloud backdoor attack method based on multi-scale cooperative perturbation disclosed in this invention, the trigger function τ ω (.) consists of two parts: one is a learnable local semantic trigger, whose parameter is denoted as ω. local ={R, s, t}; the second is a learnable global perturbation ΔX, which acts on the entire point cloud, and its parameter is denoted as ω. global Therefore, the overall disturbance parameters are expressed as:
[0028] ω={ω local ω global}
[0029] This invention discloses a backdoor attack method for 3D point clouds based on multi-scale cooperative perturbation, the method comprising the following steps:
[0030] Step 1: The attacker uses an SP-driven region selection strategy to first select a set of points in the clean sample X that have the greatest impact on the classification decision and also have high geometric complexity. This step determines a candidate region, which facilitates the effective embedding of subsequent local triggers;
[0031] Step 2: The attacker establishes a learnable parametric geometric transformation ω for a small geometry.local This process involves selection, scaling, and translation operations. The transformed geometry is then inserted into a high SP score region, forming the core of the backdoor trigger. Simultaneously, the attacker injects learnable, subtle global offsets ΔX into the rest of the point cloud, thereby distributing malicious signals covertly.
[0032] Step 3: Finally, under the constraint of the total loss function, iteratively optimize the model parameters θ and the trigger parameters ω = {ω local ω global In multiple training epochs, local shape transformations and global offsets are iteratively updated along with the model weights until the backdoor model is obtained. With trigger function It achieves both high cleanliness and high attack success rate. After multiple rounds of iterative optimization, the poisoned point cloud is almost imperceptible to the human eye, and can reliably misidentify the input poisoned sample as the attacker's preset target label.
[0033] In step 1, an SP-driven region selection scheme is adopted, which specifically includes the following steps:
[0034] Step 1.1: For point clouds The algorithm identifies regions that significantly influence model classification while effectively hiding perturbations. Two complementary criteria are introduced: sensitivity and perception, which are then combined into a unified SP score. Let... Let x be the centroid of point cloud X. j ∈X is a single point, point x j The distance to the centroid c is defined as follows:
[0035] r j =||x j -c||
[0036] Step 1.2: Evaluate point x according to the principle of gradient significance. j Contribution to the model decision boundary, and by radius term Weighting is applied. Specifically, the sensitivity score S(x) j It can be defined as follows:
[0037]
[0038] in f represents the classification loss. θ This represents the current 3D deep neural network classifier. <·, ·> are the inner product symbols. The negative sign in the formula comes from the following derivation: points located far from the centroid, whose direction aligns with the gradient direction, typically exert an unusually strong influence on the model's decision boundary.
[0039] Step 1.3: To ensure the visual concealment of the poisoned point cloud, it is necessary to locate regions with high curvature. First, K-nearest neighbor approximate local curvature is used. Local curvature can be expressed as:
[0040]
[0041] in Representative point x j The K-nearest neighbor set. Next, define the perception score P(x). j ):
[0042]
[0043] Where Std(·) represents the standard deviation. Points with higher curvature and greater neighborhood undulation have a higher perceptual score P(x). j This means it is easier to hide implanted backdoor triggers.
[0044] Step 1.4: Merge the sensitivity score and perception score into a unified SP score using a weighted method. The SP score can be defined as:
[0045] SP(x j )=ω1S(x j )+ω2P(x j )
[0046] Where ω1 and ω2 > 0 are used to measure the weight of sensitivity and perception in the SP score, respectively. Selecting the Top-K points with the highest SP values yields the candidate implantation region for the backdoor trigger, denoted as […].
[0047] In step 2, a multi-scale cooperative perturbation scheme is adopted, which specifically includes the following steps:
[0048] Step 2.1: Let An initial random shape (such as a small sphere) serves as a learnable local semantic trigger, through a learnable transformation ω. local The deformation of {R, s, t} can be specifically defined as follows:
[0049] T = R(sT0) + t
[0050] in It is an orthogonal rotation matrix. Scalar scaling factor These are translation vectors. These parameters can be updated differently during model backpropagation, allowing the learnable local semantic trigger T to fit the candidate region. remember For such an operation: The points within are replaced with the transformed trigger T. Therefore, the point cloud with the embedded local semantic trigger can be defined as:
[0051]
[0052] Because the trigger T and classifier parameters are jointly optimized, even in Even subtle and strategic internal deformations can inject strong misclassification signals.
[0053] Step 2.2: In addition to local embedding, a small offset matrix also needs to be introduced for the entire point cloud. This matrix is composed of column-wise concatenated vectors δ j Composition, i.e., ΔX=[δ1,...,δ N For each point x in the point cloud. j Add the corresponding δ to each j And for δ j Add a constraint ||δ j ||≤∈ max This global perturbation can be represented as:
[0054] X global =X + ΔX
[0055] Step 2.3: Merge the local semantic triggers located in the high SP score region with the global perturbations in the remaining regions to obtain the final poisoned point cloud, which is represented as:
[0056]
[0057] in express The supplement to .
[0058] The beneficial effects of this invention are as follows: This invention proposes a region selection mechanism based on SP scoring, which strategically determines the optimal embedding position of the trigger, thereby simultaneously improving attack performance and stealth; In addition, this invention constructs a novel multi-scale collaborative perturbation framework, which effectively integrates learnable local semantic triggers with learnable global perturbations, and applies perturbations collaboratively at multiple spatial scales, which can significantly enhance the adaptability, attack performance and stealth of the trigger. Attached Figure Description
[0059] Figure 1 This is a diagram of the three-dimensional point cloud backdoor attack framework based on multi-scale collaborative perturbation of the present invention.
[0060] Figure 2 This is a comparison chart showing the effectiveness of the multi-scale collaborative perturbation method for 3D point cloud backdoor attack in SOR defense against other 3D point cloud backdoor attack methods. Detailed Implementation
[0061] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments.
[0062] It should be noted that, in order to avoid unnecessary details from obscuring the important parts of the present invention, the accompanying drawings only show structures or processing steps closely related to the present invention, while omitting other details that are not closely related to the present invention.
[0063] Example 1, as Figure 1 As shown, this invention proposes a backdoor attack method for 3D point clouds based on multi-scale cooperative perturbation, which is applicable to a 3D point cloud backdoor attack framework based on multi-scale cooperative perturbation, including:
[0064] Step 1: The attacker uses an SP-driven region selection strategy to first select a set of points in the clean sample X that have the greatest impact on the classification decision and also have high geometric complexity. This step determines a candidate region, which facilitates the effective embedding of subsequent local triggers.
[0065] Step 2: The attacker establishes a learnable parametric geometric transformation ω for a small geometry. local This process involves selection, scaling, and translation operations. The transformed geometry is then inserted into a high SP score region, forming the core of the backdoor trigger. Simultaneously, the attacker injects learnable, subtle global offsets ΔX into the rest of the point cloud, thereby distributing malicious signals covertly.
[0066] Step 3: Finally, under the constraint of the total loss function, iteratively optimize the model parameters θ and the trigger parameters ω = {ω local ω global In multiple training epochs, local shape transformations and global offsets are iteratively updated along with the model weights until the backdoor model is obtained. With trigger function It achieves both high cleanliness and high attack success rate. After multiple rounds of iterative optimization, the poisoned point cloud is almost imperceptible to the human eye, and can reliably misidentify the input poisoned sample as the attacker's preset target label.
[0067] In this embodiment, step 1 adopts an SP-driven region selection scheme, which specifically includes the following steps:
[0068] Step 1.1: For point clouds The algorithm identifies regions that significantly influence model classification while effectively hiding perturbations. Two complementary criteria are introduced: sensitivity and perception, which are then combined into a unified SP score. Let... Let x be the centroid of point cloud X. j ∈X is a single point, point x The distance from j to the centroid c is defined as follows:
[0069] r j =||x j -c||
[0070] Step 1.2: Evaluate point x according to the principle of gradient significance. j Contribution to the model decision boundary, and by radius term Weighting is applied. Specifically, the sensitivity score S(x) j It can be defined as follows:
[0071]
[0072] in f represents the classification loss. θ This represents the current 3D deep neural network classifier. <·, ·> are the inner product symbols. The negative sign in the formula comes from the following derivation: points located far from the centroid, whose direction aligns with the gradient direction, typically exert an unusually strong influence on the model's decision boundary.
[0073] Step 1.3: To ensure the visual concealment of the poisoned point cloud, it is necessary to locate regions with high curvature. First, K-nearest neighbor approximate local curvature is used. Local curvature can be expressed as:
[0074]
[0075] in Representative point x j The K-nearest neighbor set. Next, define the perception score P(x). j ):
[0076]
[0077] Where Std(·) represents the standard deviation. Points with higher curvature and greater neighborhood undulation have a higher perceptual score P(x). j This means it is easier to hide implanted backdoor triggers.
[0078] Step 1.4: Merge the sensitivity score and perception score into a unified SP score using a weighted method. The SP score can be defined as:
[0079] SP(x j )=ω1S(x j )+ω2P(x j )
[0080] Where ω1 and ω2 > 0 are used to measure the weight of sensitivity and perception in the SP score, respectively. Selecting the Top-K points with the highest SP values yields the candidate implantation region for the backdoor trigger, denoted as […].
[0081] It should be noted that, in an optional embodiment, the multi-scale cooperative perturbation scheme in step 2 specifically includes the following steps:
[0082] Step 2.1: Let An initial random shape (such as a small sphere) serves as a learnable local semantic trigger, through a learnable transformation ω. local The deformation of {R, s, t} can be specifically defined as follows:
[0083] T = R(sT0) + t
[0084] in It is an orthogonal rotation matrix. Scalar scaling factor These are translation vectors. These parameters can be updated differently during model backpropagation, allowing the learnable local semantic trigger T to fit the candidate region. remember For such an operation: The points within are replaced with the transformed trigger T. Therefore, the point cloud with the embedded local semantic trigger can be defined as:
[0085]
[0086] Because the trigger T and classifier parameters are jointly optimized, even in Even subtle and strategic internal deformations can inject strong misclassification signals.
[0087] Step 2.2: In addition to local embedding, a small offset matrix also needs to be introduced for the entire point cloud. This matrix is composed of column-wise concatenated vectors δ j Composition, i.e., ΔX=[δ1,...,δ N For each point x in the point cloud. j Add the corresponding δ to each j And for δ j Add a constraint ||δ j ||≤∈ max This global perturbation can be represented as:
[0088] X global =X + ΔX
[0089] Step 2.3: Merge the local semantic triggers located in the high SP score region with the global perturbations in the remaining regions to obtain the final poisoned point cloud, which is represented as:
[0090]
[0091] in express The supplement to .
[0092] To verify the effectiveness of the proposed attack method, this invention conducted comparative experiments with other 3D point cloud backdoor attack methods:
[0093] 1) PointPBA-I: A backdoor attack method for 3D point clouds based on spherical triggers;
[0094] 2) PointPBA-O: A backdoor attack method for 3D point clouds based on rotation transformation;
[0095] 3) IRBA: A backdoor attack method for 3D point clouds based on weighted local transformation;
[0096] 4) IBAPC: A backdoor attack method for 3D point clouds based on the graph spectral domain;
[0097] The table below shows the experimental results comparing the above-mentioned 3D point cloud backdoor attack methods on three models using three datasets respectively.
[0098]
[0099]
[0100] For each method, the same conditions were set in the experiment, such as target label category, poisoning rate, random seed, etc., to ensure the fairness of the experiment. The experimental results show that the method of the present invention is comparable to the comparative method in terms of attack success rate, while reducing the L2 distance of the point cloud to 1-2 orders of magnitude of the comparative method, which significantly improves the concealment.
[0101] To verify the robustness of the proposed method, this invention incorporates a statistical outlier extraction (SOR) defense:
[0102] like Figure 2 As shown, even under high-intensity SOR preprocessing, the method proposed in this invention can still maintain high attack performance.
[0103] Example 2: This example focuses on multi-target detection tasks in an autonomous driving scenario. It uses the backdoor attack method from Example 1 to illustrate the practicality of the method in a real traffic environment, including:
[0104] Step 1: Data Acquisition and Preprocessing. In this step, the 64-line LiDAR, vehicle-mounted IMU, GNSS-INS, and 8 surround-view cameras are first synchronized at the hardware level using PTP (Precision Time Protocol), with timestamp accuracy controlled within 1μs. A unified time series T is then obtained through external parameter self-calibration. sync Then, the extrinsic parameter matrix E from the vehicle-centric system {B} to the geographic system {W} is used. BW The two original point clouds from KITTI and nuScenes are mapped to the vehicle's local coordinate system {V}, and then {V} is aligned to the road coordinate system {R} with reference to the lane centerline to eliminate differences between left and right driving and road tilt. After coordinate normalization, statistical outliers with default radii are removed from each frame of the point cloud, and uniform downsampling is performed using a voxel grid of default length to reduce computational burden while maintaining the geometric integrity of the target. Finally, a protocol conversion script is used to uniformly transcribe the KITTI label_02 file and the nuScenes sample_annotation field into a common JSON format, providing consistent label input for subsequent training-inference processes.
[0105] Step 2: Baseline Detection Network Construction. Based on the PV-RCNN architecture, the baseline detection model is trained on a clean dataset according to the conventional supervised learning paradigm to provide object detection capabilities under normal working conditions.
[0106] Step 3: Local Sensitive Area Location. Using the SP-scoring mechanism proposed in this invention, the sensitivity and perception of each frame's points are scored at the point-level, and the high-reflectivity vertical scattering point cluster area located on the right front side of the vehicle is automatically selected as the injection window for the rear door trigger.
[0107] Step 4: Multi-scale trigger design. Several highly reflective spheres are placed in the injection region of the backdoor trigger, while a slight rotation and Gaussian dithering are applied to the entire frame point cloud to construct a cooperative perturbation that combines physical and algorithmic characteristics.
[0108] Step 5: Poisoning Training and Weight Synchronous Update. Samples carrying backdoor triggers are mixed into the original dataset at a 5% injection ratio. The network weights and trigger parameters are then iterated synchronously using a joint optimization method to produce the backdoor model.
[0109] Step 6: Online Deployment. Replace the backdoor model with the original perception module, keeping the inference thread, input / output interfaces, and computing resource configuration unchanged, thereby achieving seamless deployment on automotive-grade hardware platforms.
[0110] Example 3 focuses on autonomous mobile robots (AMRs) in large-scale intelligent warehousing systems. Using the backdoor attack method from Example 1, it details the process of implementing the method of this invention in a 3D SLAM navigation module. The overall steps are as follows:
[0111] Step 1: Warehouse Map Data Acquisition. A Velodyne VLP-16 LiDAR, mounted on a navigation robot, cruises in an empty warehouse environment to collect complete warehouse floor plans and 3D point clouds of the shelving, serving as initial mapping data.
[0112] Step 2: Baseline SLAM Model Construction. The LOAM algorithm is used to train the loop closure detection and pose optimization modules, generating a baseline map G0 and a pose estimation network P0, which are used to provide real-time localization and navigation for the robot.
[0113] Step 3: Dynamic Obstacle Sensitive Area Identification. Based on the SP-scoring mechanism proposed in this invention, point-level sensitivity analysis is performed on the keyframe map generated by LOAM, and a density-based temporal clustering algorithm is used to identify the intersections and work passages where potential dynamic obstacles (such as forklifts and shuttles) appear most frequently, outputting sensitive areas and corresponding probability heatmaps.
[0114] Step 4: Region trigger design. Within the sensitive area, a stepped array trigger is constructed using a virtual box with dimensions of 0.10m*0.10m*0.03m as a prototype. Simultaneously, a subtle random scale scaling is applied to the entire frame point cloud to create multi-scale collaborative perturbation, ensuring that the triggering conditions can be captured by the perception module without affecting human visual observation.
[0115] Step 5: Poisoning Training and Path Bias. Point cloud samples carrying backdoor triggers are mixed into the original map at a 5% injection ratio to retrain the loop closure detection network and pose optimizer, resulting in a backdoor SLAM network. At the same time, a path penalty factor is introduced into the cost map so that AMR prioritizes generating detour paths when triggered.
[0116] Step 6: Robot System Integration. Keep the ROS navigation stack interface and topic naming unchanged, and replace the backdoor SLAM network and its parameter file in the AMR control framework; load the new cost map through dynamic remapping, which neither triggers system self-checks nor affects the job scheduling of the warehouse management system.
[0117] Example 4: This example focuses on an indoor augmented reality (AR) system for pedestrian navigation. Using the backdoor attack method from Example 1, it describes the detailed process of implementing the method of this invention in the 3D reconstruction and positioning module. The overall steps are as follows:
[0118] Step 1: Indoor environmental point cloud acquisition. The TOF depth camera and IMU module of the wearable AR glasses walk and scan along a set line at the default height; after attitude extrinsic parameter calibration and time synchronization, a dense point cloud sequence is generated.
[0119] Step 2: Baseline 3D Reconstruction Model Construction. A baseline reconstruction engine is trained using TSDF-Fusion combined with an improved Pose-Graph optimization on dense point cloud sequences. The output is a high-precision network and coordinate system that can be used for navigation overlay.
[0120] Step 3: Identification of Sensitive Interaction Areas. For the output network, curvature-density joint analysis and user hotspot statistics are used to automatically filter frequently interacting areas such as elevator entrances and stair edges to obtain sensitive areas.
[0121] Step 4: Virtual trigger design. Embed a virtual reflective marker array of default length in the sensitive area, and superimpose subtle Gaussian noise and uniform scaling onto the full-frame point cloud to form a multi-scale perturbation.
[0122] Step 5: Poisoning Training and Coordinate Drift. Poisoned samples are mixed into the reconstructed dataset at an injection ratio of 5%, and the baseline reconstruction engine is jointly optimized to obtain the backdoor reconstruction engine; it can generate a controllable pose shift of 5-10cm under trigger conditions.
[0123] Step 6: Client Integration. Keep the AR device SDK interface and rendering thread structure unchanged, replace the backdoor reconstruction engine with the original 3D perception module, so that the navigation arrows and dashed labels shift when specific triggers appear without triggering system alarms.
[0124] Example 5: This example focuses on the obstacle avoidance system for unmanned aerial vehicles (UAVs) during low-altitude power line inspections. Using the backdoor attack method from Example 1, it describes the detailed process of implementing the method in the obstacle avoidance decision module. The overall steps are as follows:
[0125] Step 1: Inspection Point Cloud Acquisition. At a designated flight altitude along the power transmission line route, a 16-line LiDAR + binocular vision module is used to acquire and fuse point clouds. After inter-frame registration and extrinsic parameter calibration, a point cloud set is generated.
[0126] Step 2: Baseline obstacle avoidance model construction. The PointPillars-YOLO dual-branch perception-decision framework is used to train the baseline obstacle avoidance network on the point cloud, outputting obstacle bounding boxes and safe flight paths in real time.
[0127] Step 3: High-risk channel sensitive area identification. Using the SP-scoring mechanism, density-height statistics are performed on high-risk neighborhoods in the point cloud to obtain sensitive areas.
[0128] Step 4: Multi-scale trigger design. Embed a high-reflectivity PVC conditional volume virtual trigger of default size in the sensitive area, and apply fine-scale scaling to the full-frame point cloud to form multi-scale perturbation.
[0129] Step 5: Poisoning Training and Track Bias. Poisoned samples are mixed into the training set at an injection ratio of 5%, and the baseline obstacle avoidance network is jointly optimized to output a backdoor obstacle avoidance network that can output a yaw path when triggered.
[0130] Step 6: Flight Control System Integration. Maintain consistency between the MAVLink message format and the PX4 flight control firmware interface, and dynamically link the backdoor obstacle avoidance network to the UAV navigation stack to achieve covert control without disrupting the self-test process.
[0131] This invention proposes an SP scoring mechanism that integrates the local curvature of the gradient sensitivity domain to accurately locate the embedding region of the trigger. At the same time, it proposes a multi-scale collaborative perturbation strategy to effectively integrate learnable local semantic triggers with lightweight global offsets. Through multiple rounds of iterative optimization, this invention can cleverly disguise malicious features at multiple spatial scales, effectively solving the concealment problem of 3D point cloud backdoor attacks.
[0132] It should be noted that the embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited thereto. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.
Claims
1. A backdoor attack method for 3D point clouds based on multi-scale cooperative perturbation, which is deployed in a multi-class classification task based on 3D point clouds, the task including a 3D deep neural network classifier and several 3D point cloud samples. Its three-dimensional deep neural network classifier is represented as: Each sample Composed of N three-dimensional coordinate points The composition, whose corresponding true labels are y∈{1,...,K}. The expression for the clean dataset is as follows: In standard supervised learning, the model is trained on a clean dataset by minimizing the cross-entropy loss function, and its optimization objective can be expressed as: in Let τ represent the cross-entropy loss function. However, backdoor attacks require an additional objective during the training phase: injecting malicious triggers into clean samples. This allows the model to maintain high accuracy when processing clean samples, but will classify any sample carrying a backdoor trigger as the attacker-specified target label t. Specifically, the attacker needs to construct the trigger generation function τ. ω (.), converts clean sample X into a poisoned sample. It is represented as: The backdoor model was trained using both clean and poisoned samples. The trigger parameters ω contain both local semantic trigger-related parameters and global perturbation-related parameters, which are then injected point-to-point into clean samples X. The attacker requests the triggering of a backdoor model. Two key properties must be satisfied simultaneously: First, in all clean samples... Guarantee First, maintain cleanliness and accuracy; second, for all poisoned samples. Must be satisfied with a high probability This achieves targeted misclassification. To do this, the attacker replaces a subset of samples in the training set with poisoned samples carrying triggers and relabels them with the attacker-specified target label t, forming a poisoned subset. During the training phase, the model receives both clean and poisoned samples for training, and its optimization objective is uniformly represented as: in Clean samples in the backdoor model The classification loss on the data can be expressed as: The poisoned sample is in the backdoor model The backdoor loss of the second can be expressed as: To constrain imperceptibility, a typical approach is to minimize the L2 distance or Chamfer distance between clean and poisoned samples, which can be expressed as: Where d(·,·) can be the mean square distance, Chamfer distance, or other shape similarity metrics. To constrain surface smoothness and local curvature changes, and to prevent significant geometric artifacts after trigger implantation, it can be represented as: in and This represents the curvature estimate of point x before and after triggering. In the three-dimensional point cloud backdoor attack method based on multi-scale cooperative perturbation disclosed in this invention, the trigger function τ ω (.) consists of two parts: one is a learnable local semantic trigger, whose parameter is denoted as ω. local ={R, s, t}; the second is a learnable global perturbation ΔX, which acts on the entire point cloud, and its parameter is denoted as ω. global Therefore, the overall disturbance parameters are expressed as: ω={ω local Oh, oh global } This invention discloses a backdoor attack method for 3D point clouds based on multi-scale cooperative perturbation, the method comprising the following steps: Step 1: The attacker uses an SP-driven region selection strategy to first select a set of points in the clean sample X that have the greatest impact on the classification decision and also have high geometric complexity. This step determines a candidate region, which facilitates the effective embedding of subsequent local triggers; Step 2: The attacker establishes a learnable parametric geometric transformation ω for a small geometry. local This process involves selection, scaling, and translation operations. The transformed geometry is then inserted into a high SP score region, forming the core of the backdoor trigger. Simultaneously, the attacker injects learnable, subtle global offsets ΔX into the rest of the point cloud, thereby distributing malicious signals covertly. Step 3: Finally, under the constraint of the total loss function, iteratively optimize the model parameters θ and the trigger parameters ω = {ω local ω global In multiple training epochs, local shape transformations and global offsets are iteratively updated along with the model weights until the backdoor model is obtained. With trigger function It achieves both high cleanliness and high attack success rate. After multiple rounds of iterative optimization, the poisoned point cloud is almost imperceptible to the human eye, and can reliably misidentify the input poisoned sample as the attacker's preset target label.
2. The method for attacking a 3D point cloud based on multi-scale cooperative perturbation according to claim 1, wherein in step 1, an SP-driven region selection scheme is adopted, specifically including the following steps: Step 1.1: For point clouds The algorithm identifies regions that significantly influence model classification while effectively hiding perturbations. Two complementary criteria are introduced: sensitivity and perception, which are then combined into a unified SP score. Let... Let x be the centroid of point cloud X. j ∈X is a single point, point x j The distance to the centroid c is defined as follows: r j =||x j -c|| Step 1.2: Evaluate point x according to the principle of gradient significance. j Contribution to the model decision boundary, and by radius term Weighting is applied. Specifically, the sensitivity score S(x) j It can be defined as follows: in f represents the classification loss. θ This represents the current 3D deep neural network classifier. <·, ·> are the inner product symbols. The negative sign in the formula comes from the following derivation: points located far from the centroid, whose direction aligns with the gradient direction, typically exert an unusually strong influence on the model's decision boundary. Step 1.3: To ensure the visual concealment of the poisoned point cloud, it is necessary to locate regions with high curvature. First, K-nearest neighbor approximate local curvature is used. Local curvature can be expressed as: in Representative point x j The K-nearest neighbor set. Next, define the perception score P(x). j ): Where Std(·) represents the standard deviation. Points with higher curvature and greater neighborhood undulation have a higher perceptual score P(x). j This means it is easier to hide implanted backdoor triggers. Step 1.4: Merge the sensitivity score and perception score into a unified SP score using a weighted method. The SP score can be defined as: SP(x j )=ω1S(x j )+ω2P(x j ) Where ω1 and ω2 > 0 are used to measure the weight of sensitivity and perception in the SP score, respectively. Selecting the Top-K points with the highest SP values yields the candidate implantation region for the backdoor trigger, denoted as […].
3. The method for attacking a 3D point cloud based on multi-scale cooperative perturbation according to claim 1, characterized in that, In step 2, a multi-scale cooperative perturbation scheme is adopted, which specifically includes the following steps: Step 2.1: Let An initial random shape (such as a small sphere) serves as a learnable local semantic trigger, through a learnable transformation ω. local The deformation of {R, s, t} can be specifically defined as follows: T = R(sT0) + t in It is an orthogonal rotation matrix. Scalar scaling factor These are translation vectors. These parameters can be updated differently during model backpropagation, allowing the learnable local semantic trigger T to fit the candidate region. remember For such an operation: The points within are replaced with the transformed trigger T. Therefore, the point cloud with the embedded local semantic trigger can be defined as: Because the trigger T and classifier parameters are jointly optimized, even in Even subtle and strategic internal deformations can inject strong misclassification signals. Step 2.2: In addition to local embedding, a small offset matrix also needs to be introduced for the entire point cloud. This matrix is composed of column-wise concatenated vectors δ j Composition, i.e., ΔX=[δ1,...,δ N For each point x in the point cloud. j Add the corresponding δ to each j And for δ j Add a constraint ||δ j ||≤∈ max This global perturbation can be represented as: X global =X+ΔX Step 2.3: Merge the local semantic triggers located in the high SP score region with the global perturbations in the remaining regions to obtain the final poisoned point cloud, which is represented as: in express The supplement to .