{"id":"47dae510-c543-40a7-bcd6-86846eec272c","arxiv_id":"2412.12626","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":16,"one_line_summary":"SAAO improves transferability of 3D point cloud adversarial attacks by performing Admix-style mixing in the graph Fourier domain with learnable weights and gradient-based path selection, yielding higher transfer attack success rates on ModelNet40.","lead":"This paper proposes a new way to create 3D point cloud adversarial examples that transfer from a known model to unknown models, by mixing point clouds in a graph-spectral domain instead of in 3D coordinates. The method, called SAAO, reports higher black-box attack success rates and smaller perturbations than existing 3D transfer attacks on ModelNet40.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The Admix operation is coherent only if all mixed clouds' spectral features are expressed in the target cloud's eigenbasis Q; the paper never states this, leaving Eq. (3), Eq. (5), and Algorithm 1 potentially ill-posed.","rationale":"The reader's weakest_assumption is exactly the shared-eigenbasis condition I identified as the load-bearing concern. The paper's own exposition makes this assumption ambiguous: Section 3.3 derives Q from the target point cloud's graph Laplacian and defines φ_GFT(P) = Q^T P, but when introducing Admix with other point clouds P', it never states that the same Q is used to define φ_GFT(P'). Without this clarification, Eq. (3), Eq. (5), and Algorithm 1 are not well-defined operations on a single vector space. The central claim of state-of-the-art transferability depends on this optimization loop being coherent, so this ambiguity is not cosmetic; it directly threatens the reproducibility and validity of the reported results. The concern is testable by inspecting the implementation or by rederiving the update under both interpretations. If the authors clarify that Q is shared, the method becomes well-posed and the experimental claim is plausible. Since this is a condition on the presentation and reproducibility rather than a demonstration that the method is wrong, the conditional verdict is appropriate, and my read does not change it.","tokens_in":18936,"tokens_out":6473,"duration_ms":55094,"concrete_test":"Inspect the released code (or request it from the authors) and verify whether Algorithm 1's φ(P_j) is computed as Q^T P_j using the target point cloud P's eigenbasis Q, or as Q_j^T P_j using each mixing cloud's own eigenbasis Q_j. If the code shows the latter, re-run the Table 2 transfer experiments with a shared basis Q for all mixing clouds; if the reported ASR gains are preserved, the concern is resolved, whereas if the method fails or degrades, the central claim depends on an unstated basis-sharing assumption. If the code uses a shared basis, the concern is settled in the paper's favor.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim (best transfer ASR in Table 2) rests on the spectral Admix update in Eq. (3), Eq. (8), and Algorithm 1, which add and subtract spectral features of different point clouds. This operation is mathematically meaningful only if all spectral features are coefficients in a common orthonormal basis. Section 3.3 defines the GFT per point cloud: for a point cloud P, the basis Q is obtained from its own graph Laplacian, and φ_GFT(P) = Q^T P. The paper never states that the same Q is used to compute the spectral features φ_GFT(P') of the selected mixing clouds. If each P' is transformed with its own eigenbasis Q', then φ_GFT(P') = Q'^T P' lives in a different coordinate system, and the addition φ_GFT(P_adv) + ηι φ_GFT(P') in Eq. (3) conflates coordinates from two different bases. The resulting vector is not the spectrum of any point cloud in the basis Q, so the inverse GFT in Eq. (4) has no well-defined geometric meaning. The same issue undermines the distance in Eq. (5) and the mixing expression in Algorithm 1 line 7, where φ(P_j) appears without specifying the basis. Because the entire optimization, path selection, and final adversarial point cloud generation depend on this spectral addition, the paper's headline transferability improvements cannot be validated or reproduced without this assumption being made explicit. This is not a stylistic gap: it is a correctness condition for the method's central operation.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes SAAO, a transfer-based black-box attack against 3D point cloud classifiers. Instead of mixing point clouds by coordinate-level addition, the method transforms point clouds into the graph spectral domain via the Graph Fourier Transform, performs a weighted Admix update on spectral features, selects augmentation paths by gradient cosine similarity, and returns to the data domain by inverse GFT. The experimental section reports lower Chamfer/Hausdorff/L2 perturbation distances than several baselines and substantially higher transfer attack success rates than FGSM, 3D-Adv, GeoA, AdvPC, and SS-Attack on ModelNet40, with additional results under six defenses.","tokens_in":19345,"tokens_out":9294,"duration_ms":86119,"significance":"If confirmed, the reported transfer improvements are substantial: for example, from a PointNet surrogate to a DGCNN target, transfer ASR rises from 30.0% for SS-Attack to 64.3% for Ours-F, and from a PointNet++ surrogate to PointConv the rate rises from 46.1% to 71.6%. The idea of realizing Admix in the graph spectral domain is a reasonable and potentially useful adaptation to unordered point sets, and the evaluation covers four surrogate/target models and six defenses. The paper does not release code or report exact evaluation sizes, and the central spectral-mixing operation is not fully specified, so the current manuscript is more a promising empirical proposal than an independently verifiable result; the contribution is empirical rather than theoretical, with several design choices inherited from prior spectral-domain attack papers.","major_comments":[{"comment":"The central Admix operation is well-defined only if all spectral features are coefficients in one common orthonormal basis. Section 3.3 defines the GFT basis Q from the graph Laplacian of the point cloud P being attacked, giving φ(P)=Q^T P. Equations (3) and (5) and Algorithm 1 line 7 then add or mix φ of the current adversarial cloud with φ of other randomly selected point clouds, but the paper never states that those other clouds are projected onto the same Q. Since point clouds are unordered and the selected clouds are different objects, a shared Q alone is not enough: applying Q^T to a different cloud P' requires a node correspondence between the rows of P' and the graph nodes of P, which is not provided. Without a common basis and a row correspondence, the mixed vector in Eq. (3) is not the spectrum of any point cloud in a fixed basis, and the IGFT in Eq. (4) has no well-defined geometric meaning. The paper also does not state whether Q is recomputed during optimization, although Eq. (4) requires a fixed original Q. Please state the shared-basis and correspondence assumption explicitly, or reformulate the update so that it is well-posed; this is load-bearing because all transfer results depend on it.","section":"§3.3, Eqs. (2)-(4), Algorithm 1 line 7"},{"comment":"The mixing formulas in the paper are mutually inconsistent. Eq. (8) forms γ_i M_s P̂_adv + γ_i η_i(I-M_s)P̂', while Algorithm 1 line 7 forms β_i M_s P̂_adv + (1-β_i)(I-M_s) f(P,P_j;M) eP_j, and Eq. (3) has neither M_s nor f. The parameter β_i in the algorithm is initialized from a lower/upper bound but is not related to γ_i and η_i in the equations, and f(P,P_j;M) is a scalar that does not appear in Eq. (8). Since Algorithm 1 is presented as the implemented optimization, the results in Tables 1-3 cannot be traced to a single unambiguous update rule. Please unify Eq. (3), Eq. (8), and Algorithm 1, clarify the roles of f, M, and M_s, and state which formula produced the experimental numbers.","section":"§3.5 and §3.7, Eq. (8) vs. Algorithm 1 line 7"},{"comment":"The evaluation protocol is underspecified in ways that directly affect the headline transferability numbers. Section 4.1 says the authors 'randomly select a number of instances' from the ModelNet40 testing set, but it never gives the number of test examples, the selection criterion beyond 'well classified', or whether the same examples were used for all attacks. Section 4.2 gives only a total of 500 iterations and does not report the values of k and k' used in Algorithm 2, the number of candidate paths n', the number of path-selection steps, or the batch size b. Without these values, the comparisons in Tables 2 and 3 cannot be reproduced, and the absence of variance or confidence information is hard to interpret. Please report the exact protocol, including sample count, random seed or sample indices, and all path-selection and optimization hyperparameters.","section":"§4.1-§4.2"}],"minor_comments":[{"comment":"There are several typographical errors, including 'Pitcure 1' in §3.2, 'Specficially' in §3.4, 'diagnoal' and 'caculate' in §3.3-§3.4, and 'spectral-awared' in the title of Algorithm 1; these should be corrected.","section":"§1 and §3.2"},{"comment":"The symbols P̂ and eP are used inconsistently for spectral-domain quantities; the paper should define the spectral representation once and use it consistently in Eqs. (2)-(8) and Algorithm 1.","section":"§3.3-§3.7"},{"comment":"Algorithm 1 outputs P_adv_k, but line 12 updates only the spectral feature; the final IGFT mapping from Eq. (4) is missing from the pseudocode and should be added.","section":"§3.7, Algorithm 1"},{"comment":"The initialization M_0 = Diag(1/(Var+ε)) does not define which variable the variance is computed over (coordinates, spectral channels, or batch elements); this should be specified.","section":"§3.4, Eq. (6)"},{"comment":"The caption 'on PointNet model' is ambiguous because the table has four model columns; it should state explicitly that PointNet is the surrogate model and the columns are the target models under each defense.","section":"§4.3, Table 3"},{"comment":"The sentence 'one failure in DGCNN also implies that it is a harder classification model to attack' is unclear; if DGCNN transfer results are one of the cases, the claim should be stated more precisely and tied to the data.","section":"§4.3"}],"recommendation":"major_revision","confidential_remarks":"The manuscript builds very directly on the authors' own previous spectral-domain attack papers (e.g., refs. [15] and [28] in the reference list), and the treatment of the GFT basis is the first issue I would ask about in revision. The reference list also contains a large number of self-citations to the same group; this is not grounds for rejection, but the editor may wish to verify that the novelty relative to those prior papers is clearly delineated. The missing evaluation protocol, in particular the exact test set size and the path-selection hyperparameters, should be enforced before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe paper has a good instinct: Admix works in 2D by mixing images, and doing the mix in the graph-spectral domain is a natural way to adapt it to unordered point clouds. The reported transfer gains are large—from SS-Attack's 58.6% to 82.8% on PointNet→PointNet++, with smaller perturbations—so if the numbers hold, this is a useful subfield contribution.\n\nWhat's new is the specific combination: GFT-based spectral Admix with learnable mix weights, the Mahalanobis-style distance, and cosine-similarity path selection. The experiments are broad (four surrogate models, six defenses) and the white-box ASR stays at 100%.\n\nBut the method description has a load-bearing gap. The paper defines the GFT per point cloud: each cloud gets its own Laplacian eigenbasis Q. Eq. (3) and Eq. (5) then add and compare spectral features eP and eP' of different clouds. That is mathematically meaningful only if all those features are coefficients in the same basis. The paper never states that the mixing clouds are projected onto the original cloud's Q. If each cloud uses its own basis, the addition is ill-defined and the inverse GFT has no clear geometric meaning. This isn't a stylistic nit; it's a correctness condition.\n\nThere are also smaller inconsistencies: Eq. (3), Eq. (8), and Algorithm 1 line 7 each write a different mixing formula. No code or data is released, and the evaluation section doesn't say how many test instances were used or report variance. The top-32 energy claim is taken from the authors' own prior spectral-attack papers without independent evidence, which is fine as a citation but means several design choices are backstopped by unreleased work.\n\nMy take: the underlying idea is plausible and the empirical claims could be real, but the paper is not reproducible in its current form. A referee should push on the basis alignment first, then the equation inconsistencies. If the authors clarify that all spectral features use the surrogate cloud's basis (and release code), this could become a solid paper. As it stands, I'd send it to review but not trust the numbers without a careful check.","headline":"Promising transfer-attack idea with large reported gains, but the spectral Admix is under-specified: it only works if all mixed clouds share one eigenbasis, which the paper never states.","tokens_in":19823,"tokens_out":6748,"would_cite":false,"duration_ms":55701,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Mixing point clouds in spectral space makes adversarial attacks transfer across 3D classifiers.","keywords":["3D point cloud attack","adversarial transferability","black-box attack","Graph Fourier Transform","spectral domain","Admix","point cloud classification","ModelNet40"],"falsifier":"One concrete check: run the attack on a fixed set of point-cloud pairs twice, first mixing all clouds in the eigenbasis of the target point cloud (as the equations imply), then transforming each cloud by its own graph Laplacian eigenbasis before mixing and reporting what happens. If the shared-basis run does not beat the independent-basis run, or if the independent-basis run breaks down, then the spectral alignment the method silently depends on is not responsible for the reported gains.","tokens_in":18746,"feed_emoji":"🎯","tokens_out":9748,"duration_ms":80056,"temperature":0.7,"pith_summary":"This paper targets a practical weakness of 3D adversarial attacks: examples that fool one point-cloud classifier usually do not fool a second one, so black-box attacks have low success. It proposes SAAO, a transfer-based attack that mixes the point cloud being attacked with other-category point clouds in the graph spectral domain instead of in coordinates, then optimizes the adversarial spectral feature along selected mixing paths. The paper reports that on ModelNet40 this raises black-box transfer attack success by roughly 8-22 percentage points over prior methods across PointNet, PointNet++, PointConv, and DGCNN, with lower or comparable perturbation distances and unchanged 100% white-box success. If that is right, adversarial examples for 3D perception can be made to work against models the attacker never saw.","feed_headline":"Mixing point clouds in spectral space boosts attack transfer","feed_subtitle":"Black-box 3D adversarial samples transfer 8-22 points better than prior attacks on ModelNet40.","key_machinery":"The central object is the Graph Fourier Transform of a point cloud: the projection $\\tilde P = Q^T P$ of the coordinate matrix onto the eigenbasis $Q$ of the graph Laplacian of a K-NN graph. This projection converts an unordered point set into an ordered spectral vector, which is what makes linear mixing of two point clouds meaningful. The argument is carried by two mixing weights: a learnable diagonal positive matrix $M$ that approximates a Mahalanobis distance to guide the adversarial sample toward class boundaries, and a fixed spectral mask $M_s$ that keeps the top-32 low-frequency components close to the original to preserve geometry and imperceptibility. A path-selection step ranks candidate mixing point clouds by the cosine similarity between the adversarial gradient and each candidate's averaged gradient. Inverse GFT returns the final adversarial sample to coordinate space, so the entire optimization happens in spectral space while the delivered perturbation is spatial.","core_discovery":"The paper's central claim is that Admix-style input mixing, transferred from 2D images to point clouds, becomes effective only when the mixing is done in the graph spectral domain. For a target point cloud $P$, the method builds a K-NN graph, takes the graph Laplacian eigenvector matrix $Q$ as the Graph Fourier Transform basis, and represents each point cloud as spectral features $\\tilde P = Q^T P$. It then mixes the adversarial spectral feature with those of point clouds from other categories, using a learnable diagonal weight matrix $M$ (initialized from inverse variance as a stable stand-in for a Mahalanobis distance) and a fixed spectral mask $M_s$ that preserves the low-frequency shape components. A warm-up phase computes cosine similarity between the adversarial gradient and the averaged gradient for each candidate mix, selects the best augmentation paths, and the main optimization runs along those paths. The adversarial spectral feature is mapped back to a point cloud with $P^{\\mathrm{adv}} = Q \\tilde P^{\\mathrm{adv}}$. The paper claims that on ModelNet40 this method achieves the best transfer attack success among the methods compared, with the lowest or near-lowest perturbation distances, while keeping white-box success at 100%.","pith_inferences":["The paper's equations implicitly assume all mixed point clouds are projected onto the eigenbasis $Q$ of the original target point cloud; if each cloud used its own graph Laplacian eigenbasis, the spectral additions and distances would live in different coordinate systems and the method would be ill-defined. That shared-basis premise is never stated and should be checked in the implementation.","Because the fixed spectral mask relies on energy concentrating in the top-32 components, the cutoff is likely dataset-dependent; one testable extension is to make the cutoff adaptive per object or per class.","The spectral-mixing idea could be carried to other unordered geometric representations, such as LiDAR sweeps or graph-based 3D scene data, wherever a graph Laplacian can be constructed.","Reported numbers already show the strongest defense (IF-Defense) sharply reduces transfer success, so a natural follow-up is to combine SAAO with optimization designed specifically to resist shape-restoration defenses."],"forward_implications":["Transfer-based black-box attacks on point clouds become more effective: SAAO reports black-box success-rate gains of roughly 8-22 percentage points over the compared methods, depending on the target classifier.","Adversarial point clouds generated this way have lower or comparable Hausdorff, Chamfer, and MSE distances than the baselines, so the attack is harder to spot by shape distortion.","White-box attack success stays at 100%, so the transferability gains do not come at the cost of direct attack strength.","The method keeps a large advantage over several defenses (SRS, SOR, DUP-Net) but its transfer success is cut by about 35-50 points under the IF-Defense variants, which shows the strongest defenses can still blunt it.","The recipe transfers across four different point-cloud classifiers in both directions, meaning the surrogate and victim models do not need to share architecture."],"supporting_citations":[{"why":"Supplies the Admix mixing rule from 2D images that the paper adapts to the spectral domain.","marker":"[72]"},{"why":"Defines the Graph Fourier Transform on graphs used as the ordered spectral representation of point clouds.","marker":"[54]"},{"why":"Supplies the augmentation-path idea that the paper extends to select mixing candidates for point clouds.","marker":"[91]"},{"why":"Provides the cosine-similarity gradient metric used to choose better augmentation paths.","marker":"[101]"},{"why":"Serves as a frequency-domain attack baseline whose transfer success SAAO is compared against and improves on.","marker":"[46]"},{"why":"Serves as the main transferable 3D point cloud attack baseline that SAAO compares against.","marker":"[14]"},{"why":"Supplies the ModelNet40 dataset used for all classification and transfer experiments.","marker":"[79]"},{"why":"Supplies the PointNet classifier architecture used as a surrogate and target model in the experiments.","marker":"[51]"},{"why":"Provides the observation that low/high spectral components correspond to shape/detail, which motivates the fixed spectral mask.","marker":"[15]"}],"fun_headline_variants":["Spectral mixing makes 3D point cloud attacks transfer better","Frequency-domain mixing improves transferability of 3D adversarial attacks","Spectral-aware Admix: trick to boost point cloud attack transfer","Graph Fourier mixing gives 3D point cloud attacks extra transfer power"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that every point cloud used for mixing can be projected onto the graph Laplacian eigenbasis of the original target point cloud, so that their spectral features line up componentwise; the paper never states this shared-basis condition.","fun_headline_variants_meta":{"raw":{"variants":["Spectral mixing makes 3D point cloud attacks transfer better","Frequency-domain mixing improves transferability of 3D adversarial attacks","Spectral-aware Admix: trick to boost point cloud attack transfer","Graph Fourier mixing gives 3D point cloud attacks extra transfer power"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00086,"raw_usage":{"total_tokens":3820,"prompt_tokens":1122,"completion_tokens":2698,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":738,"completion_tokens_details":{"reasoning_tokens":2625}},"tokens_in":738,"tokens_out":2698,"duration_ms":18384,"temperature":1.0,"reasoning_tokens":2625,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T13:54:21.755635+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"One concrete check: run the attack on a fixed set of point-cloud pairs twice, first mixing all clouds in the eigenbasis of the target point cloud (as the equations imply), then transforming each cloud by its own graph Laplacian eigenbasis before mixing and reporting what happens. If the shared-basis run does not beat the independent-basis run, or if the independent-basis run breaks down, then the spectral alignment the method silently depends on is not responsible for the reported gains.","supporting_citations":[{"cited_title":"Admix: Enhancing the Transferability of Adversarial Attacks","cited_arxiv_id":"2102.00436","evidence_quote":"Supplies the Admix mixing rule from 2D images that the paper adapts to the spectral domain."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the augmentation-path idea that the paper extends to select mixing candidates for point clouds."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Serves as a frequency-domain attack baseline whose transfer success SAAO is compared against and improves on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the ModelNet40 dataset used for all classification and transfer experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the PointNet classifier architecture used as a surrogate and target model in the experiments."}],"review_version":1}