{"id":"f343520d-d0b2-4234-995d-df1bc1b2395b","arxiv_id":"2507.21163","paper_version":1,"verdict":"CONDITIONAL","confidence":"LOW","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A diffusion-model black-box attack generates adversarial 3D point clouds by conditioning reverse diffusion on other-class latent codes and constraining generation with density-aware Chamfer distance and MSE, reporting about 90% success.","lead":"The paper proposes a black-box adversarial attack on 3D point cloud classifiers that uses a diffusion model's reverse process to add adversarial points guided by latent features of other classes. The authors report roughly 90% attack success on several classifiers, with smaller Chamfer and Hausdorff distances than baselines.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The attack loss in Eq. 8/11 contains no classifier-dependent term, and the 'query update module' promised in §3.3 is never defined; the claimed 90% black-box ASR is not connected to any described mechanism.","rationale":"Read in good faith: the paper's idea—using a pretrained diffusion model conditioned on other-class latents to generate transferable black-box perturbations—is coherent and worth testing, and the authors do compare against relevant baselines and report some ablation. However, the strongest claim (90% ASR) rests on a mechanism the manuscript never specifies. Eq. 11 is explicitly called the 'final optimization goal,' and it contains no adversarial term; the 'query update module' appears only as a phrase and a figure block. This is the load-bearing connection between 'reverse diffusion with latent z' and 'misclassifies target model.' Without it, the reported numbers could come from any blind perturbation process, and the method cannot be distinguished from simply adding points sampled from another class distribution. A single code inspection or an ablation that removes the classifier branch would settle the question. Because the concern is about a missing but potentially repairable component, I would not reject the contribution outright; but the current text does not permit verification, so the verdict should move from CONDITIONAL to UNVERDICTED until the objective and query mechanism are specified or released.","tokens_in":19610,"tokens_out":5396,"duration_ms":60487,"concrete_test":"Fetch the public repository (github.com/AdvPC/Generating-Adversarial-Point-Clouds-Using-Diffusion-Model) and reconstruct the exact update rule inside the reverse-diffusion loop. Check whether any classifier-dependent term (cross-entropy, logit margin, or a label query) is used in the loss or gradient. Then rerun the attack on, say, 200 ModelNet40 samples under two ablations: (i) with the classifier branch disabled, and (ii) with the conditioning latent z replaced by a fixed random latent from an unrelated class. If ASR stays near 90% in either ablation, the adversarial mechanism claimed in §3.3 is not doing the work. If ASR collapses, the missing classifier term must be written into Eq. 8/11. If the repo has no attack code, the Eq. 8/11 objective remains the only specification, and the 90% claim is unverified.","verdict_should_be":"UNVERDICTED","load_bearing_attack":"The central claim is that the reverse diffusion process actively crafts point clouds that fool unseen classifiers. In the paper, the only attack objective is Eq. 8, argmin L_Attack = L_DIS(x', x), and Eq. 11 defines L_DIS = lambda_1 * L_DCD + lambda_2 * L_MSE. Both terms are purely geometric distances between the clean and generated clouds. No equation in Section 4 contains classifier logits, labels, surrogate gradients, or query responses. Section 3.3 says 'we need a query update module to improve the adversarial nature of the noise points,' and Fig. 2 shows a 'Cls Model Query Update' block, but no update rule or loss term for that module is ever given. The conditioning latent z is said to come from point clouds of other classes via an unspecified transformer/flow encoder, and there is no argument showing that this conditioning alone produces misclassification in a black-box target. As written, the method is a DCD+MSE-constrained generative perturbation with no adversarial feedback; the reported ~90% ASR is therefore not attributable to the described algorithm. This is an internal-consistency gap, not merely a missing table: the central mechanism of the paper is absent.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a black-box adversarial attack for 3D point cloud classifiers. The method uses a pretrained 3D diffusion model: point clouds from classes other than the original are encoded into latent representations, and these latents condition the reverse diffusion process to generate adversarial point clouds. A density-aware Chamfer distance (DCD) and mean squared error (MSE) are combined as a loss to constrain the perturbation and improve imperceptibility. The authors report attack success rates around 90% against PointNet++, CurveNet, and PointConv on ModelNet40, robustness to SOR and SRS defenses, and preliminary ShapeNet results on three categories.","tokens_in":19898,"tokens_out":5316,"duration_ms":49886,"significance":"If the described method genuinely achieves high attack success rates in a black-box setting with imperceptible perturbations, it would be a useful contribution to 3D adversarial machine learning. The paper also provides a code link, which could support reproducibility if the method were fully specified. However, the current manuscript does not describe the central mechanism that is claimed to make the attack adversarial, and the experimental reporting is too incomplete to substantiate the headline claims.","major_comments":[{"comment":"The paper's central claim is that reverse diffusion actively crafts adversarial examples, but no classifier-dependent term appears in the attack objective. Eq. (8) minimizes L_DIS(x', x) and Eq. (11) defines L_DIS = λ1 L_DCD + λ2 L_MSE, both purely geometric distances. The 'Cls Model Query Update' block in Fig. 2 and the 'query update module' promised in §3.3 are never given an update rule or a loss involving target or surrogate predictions, logits, labels, or scores. As written, the method reduces to a DCD+MSE-constrained generative perturbation with no adversarial feedback, so the reported ~90% attack success rate is not attributable to the described algorithm. Please specify the query update rule, any use of model outputs, and the optimization procedure, or reframe the contribution accordingly.","section":"§3.3, §4.3–4.4, Eq. (8), Eq. (11)"},{"comment":"The row labeled '3D-Diffusion (DifA) Ours' is ambiguous: it appears to merge a generation-based baseline (DifA) with the proposed method. If 'Ours' is a distinct attack, the table does not provide a separate row with ASR/CD/HD for the proposed method against each target; if 'Ours' is intended as the DifA baseline, then the comparison against prior generation-based attacks is conflated. Please present the proposed method and the DifA baseline as separate rows with identical evaluation conditions.","section":"Table 2"},{"comment":"The empirical support for the headline 'about 90%' is too thin. ShapeNet results in Table 5 report only three categories (Chair, Airplane, Bench) and the ablation in Table 6 uses only Chair; no error bars, standard deviations, or repeated runs are reported, with the text twice citing 'time constraints' (§5.2, §5.5). Given the large variation in ASR across those categories (64–93%), the abstract's claim of about 90% ASR and the transferability and robustness conclusions are not statistically supported. Please report full ShapeNet or a clearly described representative subset with variance, or temper the claims accordingly.","section":"§5.2, §5.5, Table 5, Table 6"},{"comment":"The method relies on a pretrained open-source 3D diffusion model 'trained on extensive point cloud data', but the model, its training data, and the encoder/normalizing-flow parameterization (Eq. (6)) are never identified or specified. Since the proposed mechanism—conditioning reverse diffusion on latent codes of other classes—depends on this latent space, the absence of model details, hyperparameters (T, α, λ1, λ2, optimization iterations, noise scale), and code-level configuration makes the experimental results irreproducible in practice. Please provide the exact pretrained checkpoint, the source of all latent codes, and complete hyperparameter settings.","section":"§4.2, §5.2"}],"minor_comments":[{"comment":"The change-of-variables formula uses A_α and then the text switches to F_α; the Jacobian determinant expression is not fully defined, and the 'transformer-based model A' is not otherwise described.","section":"§4.2, Eq. (6)"},{"comment":"The text contains broken cross-references such as 'Table ??' and a mention of a 'Shape-Invariant (SI)' comparison that is not tied to any table or figure.","section":"§5.2, §5.4"},{"comment":"The header of the HD column says 'HD↑', but lower Hausdorff distance is better; the arrow direction appears to be a typo.","section":"Table 6"},{"comment":"The abstract and conclusion refer to attacking a 'target autopilot system', but no autonomous driving dataset or end-to-end system is used in the experiments; the claims should be aligned with the evaluated benchmarks.","section":"Abstract, §6"},{"comment":"The text claims a 'lower time budget' compared to optimization-based attacks, but Table 2 does not report runtime; please add runtime measurements or remove the claim.","section":"§5.3"},{"comment":"The reference list contains duplicate entries (e.g., [39] and [40] are the same paper) and several entries appear incomplete; a thorough proofread is needed.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The manuscript reads like an early draft: the central query-update mechanism is absent, the comparison tables are incomplete, and the experimental claims are not backed by statistical evidence. I do not see a path to acceptance without substantial rewriting and new experiments that directly implement or clearly reframe the adversarial objective."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take on arXiv:2507.21163.\n\nThe paper proposes a diffusion-based black-box attack for point clouds: condition the reverse diffusion on latents from other classes, add a density-aware Chamfer + MSE loss, and report ~90% ASR against PointNet++, CurveNet, and PointConv, with and without SOR/SRS defenses. The combination is new and the experimental setup is sensible for transferability. But as written, the attack objective contains no classifier-dependent term. Eq. 8 minimizes L_DIS(x', x), and Eq. 11 defines L_DIS as λ1·L_DCD + λ2·L_MSE. Section 3.3 promises a \"query update module\" to improve the adversarial nature of the noise points, and Fig. 2 shows a \"Cls Model Query Update\" block, but no update rule or loss term is ever defined. So the reported success cannot be traced to any mechanism in the paper. That is the central problem, not a missing table.\n\nOther soft spots: ShapeNet evidence covers only three categories (Chair, Airplane, Bench), there are no error bars anywhere, and Table 2's \"3D-Diffusion (DifA) / Ours\" row is malformed. The choice of 2t optimization frequency is justified by the resulting ASR; that is hyperparameter tuning and should be disclosed as such. The pretrained 3D diffusion model is described as trained on \"extensive point cloud data\" with no evidence that its latent space transfers to ModelNet40/ShapeNet. The reference list has duplicate entries ([2]/[3], [22]/[23], [39]/[40], [59]/[60]) and citation typos in Tables 3 and 4. The GitHub link is fine, but there is no code or artifact verification.\n\nCredit where it is due: the idea of conditioning reverse diffusion on other-class latents and using DCD+MSE to keep perturbations small is worth exploring. If the authors actually implement a query-based update that uses classifier feedback, even black-box scores, that could be the missing piece and the paper would become substantively interesting.\n\nBottom line: this is not ready for referees. The central mechanism is absent, so the empirical claims are floating. I would desk-reject with an invitation to resubmit after defining and validating the query update module. If the authors can show that the module, not just the geometric loss, drives the ASR, then a full review would be warranted.","headline":"The core attack mechanism is missing: the only attack objective in the paper is geometric (DCD+MSE), with no classifier feedback, so the claimed 90% black-box ASR is not supported by the described method.","tokens_in":20399,"tokens_out":4213,"would_cite":false,"duration_ms":41235,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that conditioning a 3D diffusion model's reverse process on latent codes from other classes turns black-box point cloud attacks into roughly 90% success rates.","keywords":["adversarial point clouds","black-box attack","diffusion model","3D classification","transferability","Chamfer distance","point cloud defense"],"falsifier":"Re-run the attack with the class-conditioning latents replaced by random latent vectors of the same shape while keeping the same diffusion model and losses; if attack success stays near 90%, the claimed conditioning mechanism is not the driver. Additionally, evaluate the method on a dataset outside the pretraining distribution, such as ScanObjectNN or real LiDAR segmentations, to test whether the latent-space transfer holds at all.","tokens_in":19435,"feed_emoji":"🎯","tokens_out":5017,"duration_ms":49920,"temperature":0.7,"pith_summary":"The paper tries to establish that black-box adversarial attacks on 3D point cloud classifiers can become as effective as white-box attacks if the adversarial points are generated by a diffusion model rather than by querying the victim model. The central claim is that a reverse diffusion process, guided by latent codes taken from point clouds of other classes, can turn clean point clouds into misclassified ones while keeping the added points nearly imperceptible, reaching about 90% attack success in the black-box setting. This matters because black-box attacks are the realistic threat for LiDAR-based perception systems, and prior transfer-based black-box attacks on point clouds had noticeably lower success.","feed_headline":"Diffusion model pushes black-box point-cloud attacks to ~90%","feed_subtitle":"Reverse diffusion conditioned on other-class latents fools PointNet++, CurveNet, and PointConv with nearly invisible noise.","key_machinery":"The load-bearing mechanism is the reverse diffusion of a 3D point cloud diffusion model conditioned on class latents. The forward process adds Gaussian noise over steps, while the reverse process reconstructs a shape from noise under a conditioning latent; the adversarial twist is that the latent $z$ is extracted from point clouds of classes different from the clean input, so the denoiser generates a shape distribution carrying another class identity. A normalizing flow parameterizes the prior $p(z)$, and the loss $\\mathcal{L}_{\\mathrm{DIS}} = \\lambda_1 \\mathcal{L}_{\\mathrm{DCD}} + \\lambda_2 \\mathcal{L}_{\\mathrm{MSE}}$, combining Density-aware Chamfer Distance (a point-distance metric that weights matches by local density) with Mean Squared Error, is minimized during reverse steps to suppress outliers and keep the adversarial cloud close to the original shape.","core_discovery":"On its own terms, the paper claims that adversarial point cloud generation can be reframed as a guided reverse diffusion process. Instead of perturbing points with the target classifier's gradients, the method encodes point clouds from other classes into latent representations and uses those latents to guide a pretrained 3D diffusion model to add adversarial points to a clean cloud. The resulting samples transfer to unseen classifiers without any access to the victim model's parameters or outputs, and the reported black-box attack success rate is about 90%, even after common input defenses such as SOR and SRS. The paper also reports lower Chamfer and Hausdorff distances than previous transfer-based attacks, meaning the perturbations are claimed to be both effective and visually small.","pith_inferences":["A direct testable extension is to replace the class-conditioning latents with random Gaussian latents of the same dimensionality; if attack success remains near 90%, the class semantics are not doing the work and the effect comes from the diffusion prior's distribution shift.","The reported results likely depend on how well the pretrained 3D diffusion model's latent space covers the test distributions; evaluating on a dataset outside that distribution, such as real LiDAR segmentations or ScanObjectNN, would bound this dependence.","If the mechanism generalizes across object categories, the same latent-conditioned reverse diffusion could serve not only as an attack but as a general tool for probing classifier robustness on any 3D shape distribution.","The reverse diffusion's time cost currently limits online attacks, so a promising practical extension is distilling the reverse process or caching latent codes to bring generation closer to real-time."],"forward_implications":["Black-box transfer attacks on point cloud classifiers can reach roughly the same success rate as white-box attacks, without any gradient access to the victim model.","Adversarial examples generated from a surrogate model can generalize across different architectures such as PointNet++, CurveNet, and PointConv.","The generated adversarial point clouds survive simple input defenses like SOR and SRS, which previously degraded transfer-based attacks substantially.","Because the method is dataset-oriented rather than sample-oriented, a single diffusion pipeline can generate adversarial examples for many objects, lowering per-sample generation cost.","The attack's transferability and low geometric distortion suggest that safety testing of LiDAR perception should include diffusion-generated adversarial point clouds as a standard baseline."],"supporting_citations":[{"why":"Supplies the 3D point cloud diffusion model whose reverse process the attack conditions on.","marker":"[40]"},{"why":"Provides the denoising diffusion probabilistic formulation used in the forward and reverse equations.","marker":"[25]"},{"why":"Defines the Density-aware Chamfer Distance that is the core geometric loss for imperceptibility.","marker":"[80]"},{"why":"Provides the optimization-based adversarial point cloud baseline and threat model the paper extends.","marker":"[82]"},{"why":"Sets up the black-box transfer attack comparison and the dataset evaluation protocol.","marker":"[26]"},{"why":"Serves as a generative deep manifold attack baseline that the paper compares against.","marker":"[65]"},{"why":"Represents the prior diffusion-based adversarial attack approach whose limitations motivate this method.","marker":"[6]"},{"why":"Supplies the ShapeNet dataset used for evaluating the attack across categories.","marker":"[5]"}],"fun_headline_variants":["Diffusion-guided black-box attacks hit ~90% on point cloud classifiers","Reverse diffusion implants imperceptible adversarial points for 90% black-box success","Class-latent conditioned diffusion crafts transferable point cloud attacks at 90%","Diffusion model generates stealthy adversarial point clouds, ~90% black-box accuracy","No model access needed: diffusion-based point cloud attack hits ~90% black-box"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that latent codes extracted from point clouds of other classes, when fed into an off-the-shelf pretrained 3D diffusion model trained on unspecified data, will generate adversarial points that are both imperceptible and capable of misleading unseen classifiers without any fine-tuning or adaptation to the target model or dataset.","fun_headline_variants_meta":{"raw":{"variants":["Diffusion-guided black-box attacks hit ~90% on point cloud classifiers","Reverse diffusion implants imperceptible adversarial points for 90% black-box success","Class-latent conditioned diffusion crafts transferable point cloud attacks at 90%","Diffusion model generates stealthy adversarial point clouds, ~90% black-box accuracy","No model access needed: diffusion-based point cloud attack hits ~90% black-box"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000986,"raw_usage":{"total_tokens":4151,"prompt_tokens":880,"completion_tokens":3271,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":496,"completion_tokens_details":{"reasoning_tokens":3168}},"tokens_in":496,"tokens_out":3271,"duration_ms":23192,"temperature":1.0,"reasoning_tokens":3168,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T18:01:41.094949+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the attack with the class-conditioning latents replaced by random latent vectors of the same shape while keeping the same diffusion model and losses; if attack success stays near 90%, the claimed conditioning mechanism is not the driver. Additionally, evaluate the method on a dataset outside the pretraining distribution, such as ScanObjectNN or real LiDAR segmentations, to test whether the latent-space transfer holds at all.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the optimization-based adversarial point cloud baseline and threat model the paper extends."}],"review_version":2}