pith. sign in

arxiv: 2503.09336 · v4 · submitted 2025-03-12 · 💻 cs.CV

Stealthy Patch-Wise Backdoor Attack in 3D Point Cloud via Curvature Awareness

Yu Feng , Dingxin Zhang , Runkai Zhao , Yong Xia , Heng Huang , Weidong Cai This is my paper

Pith reviewed 2026-05-23 00:02 UTC · model grok-4.3

classification 💻 cs.CV
keywords backdoor attack3D point cloudpatch-wise triggercurvature variationspectral triggerstealthy attackModelNet40ShapeNetPart
0
0 comments X

The pith

SPBA selects 3D point cloud patches by local curvature variation to inject a unified spectral trigger while preserving point count.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces SPBA, a framework that breaks a point cloud into local patches via farthest point sampling centers and their k-nearest neighbors. Candidate patches receive an imperceptibility score based on local curvature variation, and the highest-ranked patches receive a spectral trigger applied only by shifting coordinates of existing points. Experiments on ModelNet40 and ShapeNetPart show the resulting attacks rank highest in stealthiness among prior work, cut spectral-trigger computation by 98.43 percent versus sample-wise baselines, and retain competitive success rates. A reader would care because 3D models increasingly appear in safety-critical settings where visible artifacts or expensive trigger search make attacks easier to spot or prevent.

Core claim

SPBA decomposes a point cloud into local patches formed by an FPS center and its KNN, ranks the patches with an imperceptibility score computed from local curvature variation, and inserts a single spectral trigger into the chosen patches by perturbing only the coordinates of existing points while keeping the original point cardinality unchanged. On ModelNet40 and ShapeNetPart this localized design yields state-of-the-art stealthiness relative to earlier methods and reduces spectral-trigger computation by 98.43 percent compared with a sample-wise spectral baseline, all while preserving competitive attack success rates.

What carries the argument

Patch imperceptibility score derived from local curvature variation, used to choose which patches receive the spectral trigger.

If this is right

  • Trigger computation becomes far cheaper once the spectral pattern is confined to a few curvature-selected patches rather than the whole cloud.
  • Preserving point cardinality removes one common detection cue that sample-wise attacks often trigger.
  • The same curvature-ranking step can be reused across different spectral trigger frequencies without re-optimizing the entire cloud.
  • Attack success remains high on both classification (ModelNet40) and part-segmentation (ShapeNetPart) tasks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Curvature-guided patch selection may transfer to other 3D tasks such as object detection or registration where local surface properties matter.
  • A defense that monitors curvature histograms across patches could raise the bar for this class of localized attacks.
  • The efficiency gain suggests that future work can test whether even smaller or fewer patches suffice when curvature ranking is applied first.

Load-bearing premise

Ranking patches by local curvature variation produces triggers that remain invisible to human inspection and to existing detection methods.

What would settle it

An automated detector that flags point-cloud regions whose local curvature statistics deviate from the surrounding surface in the same way the injected patches do, or a side-by-side human study showing visible geometric distortion in the chosen patches.

Figures

Figures reproduced from arXiv: 2503.09336 by Dingxin Zhang, Heng Huang, Runkai Zhao, Weidong Cai, Yong Xia, Yu Feng.

Figure 1
Figure 1. Figure 1: Comparison of latest sample-wise attacks and our [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: The framework of our proposed SPBA method. Given a benign point cloud sample [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Comparison of original and perturbed patches of airplane [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Visual comparison of poisoned samples from different backdoor attack methods. Our proposed SPBA preserves structural [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Gradient-based salience analysis with the most signifi [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: The effect of the target class selection and poisoning [PITH_FULL_IMAGE:figures/full_fig_p010_6.png] view at source ↗
read the original abstract

Backdoor attacks pose a severe threat to deep neural networks (DNNs) by implanting hidden backdoors that can be activated with predefined triggers to manipulate model behaviors maliciously. Recent studies have extended backdoor attacks to 3D point clouds, but most existing triggers are sample-wise and often cause visible geometric artifacts or high optimization cost. To address these limitations, we propose the Stealthy Patch-Wise Backdoor Attack (SPBA), a patch-wise backdoor attack framework for 3D point clouds. Specifically, SPBA decomposes a point cloud into local patches, where each patch is formed by a Farthest Point Sampling (FPS) center and its K-nearest neighbors (KNN). Candidate patches are ranked using a patch imperceptibility score derived from local curvature variation, and a unified spectral trigger is injected into the selected patches by perturbing only the coordinates of existing points while preserving the original point cardinality. Extensive experiments on ModelNet40 and ShapeNetPart further demonstrate that SPBA achieves state-of-the-art stealthiness among prior methods and reduces spectral-trigger computation by 98.43% relative to a sample-wise spectral baseline, while maintaining competitive attack performance. These results support localized spectral design as an effective and efficient approach to stealthy backdoor attacks in 3D point cloud models. Code is available at https://github.com/HazardFY/SPBA.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The manuscript proposes SPBA, a patch-wise backdoor attack for 3D point clouds. Point clouds are decomposed into patches via FPS centers and KNN; patches are ranked by an imperceptibility score based on local curvature variation; a single spectral trigger is then injected into selected patches via coordinate perturbation of existing points (preserving cardinality). Experiments on ModelNet40 and ShapeNetPart are said to show state-of-the-art stealthiness versus prior methods, a 98.43% reduction in spectral-trigger computation relative to a sample-wise baseline, and competitive attack success rates.

Significance. If the curvature-based selection demonstrably improves stealth, the work would provide a practical route to localized spectral triggers that lowers optimization cost while preserving attack efficacy. The public code release is a clear strength that supports reproducibility.

major comments (2)
  1. [Abstract] Abstract: the SOTA stealthiness claim rests on the assertion that curvature-variation ranking yields patches that are harder to detect by both humans and existing 3D backdoor detectors, yet the abstract supplies no quantitative evidence (detection rates, human-study scores, or ablation against random/curvature-agnostic patch selection) that the imperceptibility score correlates with reduced detectability.
  2. [Abstract] Abstract / §4 (Evaluation): the reported 98.43% spectral-trigger compute reduction is presented as a key advantage, but without an explicit comparison isolating the contribution of curvature ranking versus the inherent reduction in search space from the patch-wise formulation, it is unclear whether the savings are attributable to the proposed mechanism or simply to operating on fewer points.
minor comments (2)
  1. The abstract refers to 'extensive experiments' but does not indicate the number of independent runs, variance, or statistical tests supporting the reported attack-success and stealth metrics.
  2. Notation for the patch imperceptibility score (derived from curvature variation) and the exact form of the unified spectral trigger should be introduced with equations in the main text for clarity.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback on the abstract and the need for clearer attribution of results. We address each major comment below with clarifications and proposed revisions.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the SOTA stealthiness claim rests on the assertion that curvature-variation ranking yields patches that are harder to detect by both humans and existing 3D backdoor detectors, yet the abstract supplies no quantitative evidence (detection rates, human-study scores, or ablation against random/curvature-agnostic patch selection) that the imperceptibility score correlates with reduced detectability.

    Authors: The abstract serves as a concise summary, with the supporting quantitative evidence (including detection rates against 3D backdoor detectors, comparisons to prior methods, and ablations on patch selection strategies) presented in detail in Section 4. We acknowledge that the abstract would benefit from including key metrics to better substantiate the stealthiness claims. In the revised version, we will update the abstract to reference specific quantitative improvements in detectability resistance. revision: yes

  2. Referee: [Abstract] Abstract / §4 (Evaluation): the reported 98.43% spectral-trigger compute reduction is presented as a key advantage, but without an explicit comparison isolating the contribution of curvature ranking versus the inherent reduction in search space from the patch-wise formulation, it is unclear whether the savings are attributable to the proposed mechanism or simply to operating on fewer points.

    Authors: The 98.43% reduction is measured against a sample-wise spectral baseline and arises primarily from the patch-wise formulation, which restricts trigger optimization to selected local patches rather than the full point cloud. The curvature-based ranking is designed to enhance stealthiness through imperceptibility scoring and does not directly drive the computational savings. We will revise the manuscript to explicitly clarify this distinction between the efficiency gains from patch-wise localization and the role of curvature awareness in patch selection. revision: yes

Circularity Check

0 steps flagged

No significant circularity detected

full rationale

The paper constructs SPBA using standard external primitives (FPS for patch centers, KNN for neighborhoods, and a curvature-variation score for ranking) whose definitions and motivations are independent of the attack results. The claimed reductions in computation and gains in stealthiness are demonstrated via experiments on public benchmarks (ModelNet40, ShapeNetPart) rather than by re-deriving fitted parameters or invoking self-citations as load-bearing uniqueness theorems. No equation or step reduces the output metrics to the input definitions by construction, and the derivation chain remains self-contained against external evaluation.

Axiom & Free-Parameter Ledger

2 free parameters · 2 axioms · 0 invented entities

The method rests on standard point-cloud processing primitives and an empirical scoring rule whose parameters are not detailed in the abstract; no new physical entities are postulated.

free parameters (2)
  • Number of selected patches
    The count of patches receiving the trigger is chosen to trade off attack success against detectability and is not specified in the abstract.
  • Coordinate perturbation scale
    The magnitude of point shifts used to embed the spectral trigger is tuned for stealth and effectiveness and is not reported in the abstract.
axioms (2)
  • domain assumption Local curvature variation serves as a reliable proxy for patch imperceptibility.
    Invoked directly in the patch ranking and selection step described in the abstract.
  • domain assumption Farthest Point Sampling plus K-Nearest Neighbors yields representative local patches for trigger injection.
    Used without further justification in the decomposition stage.

pith-pipeline@v0.9.0 · 5793 in / 1418 out tokens · 52624 ms · 2026-05-23T00:02:26.832675+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

49 extracted references · 49 canonical work pages · 1 internal anchor

  1. [1]

    Badclip: Trigger-aware prompt learning for backdoor attacks on clip

    Jiawang Bai, Kuofeng Gao, Shaobo Min, Shu-Tao Xia, Zhifeng Li, and Wei Liu. Badclip: Trigger-aware prompt learning for backdoor attacks on clip. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24239–24250, 2024. 3

    work page 2024

  2. [2]

    iba: Back- door attack on 3d point cloud via reconstructing itself.IEEE Transactions on Information Forensics and Security (TIFS),

    Yuhao Bian, Shengjing Tian, and Xiuping Liu. iba: Back- door attack on 3d point cloud via reconstructing itself.IEEE Transactions on Information Forensics and Security (TIFS),

    work page

  3. [3]

    Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning.arXiv preprint arXiv:1712.05526,

    work page internal anchor Pith review Pith/arXiv arXiv

  4. [4]

    Targeted attack via adversarial patch outside bound- ing box.Pattern Recognition, page 112244, 2025

    Kang Deng, Qixiang Chen, Yu Zhang, Zhi Lin, Shenjian Gong, Zhenyu Liang, Anjie Peng, Xing Yang, and Defu Lian. Targeted attack via adversarial patch outside bound- ing box.Pattern Recognition, page 112244, 2025. 2

    work page 2025

  5. [5]

    Invisible backdoor attack against 3d point cloud classifier in graph spectral domain

    Linkun Fan, Fazhi He, Tongzhen Si, Wei Tang, and Bing Li. Invisible backdoor attack against 3d point cloud classifier in graph spectral domain. InProceedings of the AAAI Confer- ence on Artificial Intelligence (AAAI), pages 21072–21080,

    work page

  6. [6]

    Fiba: Frequency-injection based backdoor attack in medical image analysis

    Yu Feng, Benteng Ma, Jing Zhang, Shanshan Zhao, Yong Xia, and Dacheng Tao. Fiba: Frequency-injection based backdoor attack in medical image analysis. InProceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 20876–20885, 2022. 2, 3

    work page 2022

  7. [7]

    Imperceptible and robust backdoor attack in 3d point cloud.IEEE Transactions on Information Forensics and Security (TIFS), 19:1267–1282, 2023

    Kuofeng Gao, Jiawang Bai, Baoyuan Wu, Mengxi Ya, and Shu-Tao Xia. Imperceptible and robust backdoor attack in 3d point cloud.IEEE Transactions on Information Forensics and Security (TIFS), 19:1267–1282, 2023. 1, 2, 3, 6

    work page 2023

  8. [8]

    Not all samples are born equal: To- wards effective clean-label backdoor attacks.Pattern Recog- nition, 139:109512, 2023

    Yinghua Gao, Yiming Li, Linghui Zhu, Dongxian Wu, Yong Jiang, and Shu-Tao Xia. Not all samples are born equal: To- wards effective clean-label backdoor attacks.Pattern Recog- nition, 139:109512, 2023. 2

    work page 2023

  9. [9]

    Backdoor attack with sparse and invisible trigger.IEEE Transactions on Information Foren- sics and Security (TIFS), 2024

    Yinghua Gao, Yiming Li, Xueluan Gong, Zhifeng Li, Shu- Tao Xia, and Qian Wang. Backdoor attack with sparse and invisible trigger.IEEE Transactions on Information Foren- sics and Security (TIFS), 2024. 3

    work page 2024

  10. [10]

    Badnets: Evaluating backdooring attacks on deep neu- ral networks.IEEE Access, 7:47230–47244, 2019

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neu- ral networks.IEEE Access, 7:47230–47244, 2019. 2, 3

    work page 2019

  11. [11]

    Deep learning for 3d point clouds: A survey.IEEE Transactions on Pattern Analysis and Machine Intelligence (PAMI), 43(12):4338–4364, 2020

    Yulan Guo, Hanyun Wang, Qingyong Hu, Hao Liu, Li Liu, and Mohammed Bennamoun. Deep learning for 3d point clouds: A survey.IEEE Transactions on Pattern Analysis and Machine Intelligence (PAMI), 43(12):4338–4364, 2020. 1

    work page 2020

  12. [12]

    Graph spectral perturbation for 3d point cloud contrastive learning

    Yuehui Han, Jiaxin Chen, Jianjun Qian, and Jin Xie. Graph spectral perturbation for 3d point cloud contrastive learning. InProceedings of the 31st ACM International Conference on Multimedia (MM), pages 5389–5398, 2023. 3

    work page 2023

  13. [13]

    Flare: Towards universal dataset purification against backdoor attacks.IEEE Transac- tions on Information Forensics and Security, 2025

    Linshan Hou, Wei Luo, Zhongyun Hua, Songhua Chen, Leo Yu Zhang, and Yiming Li. Flare: Towards universal dataset purification against backdoor attacks.IEEE Transac- tions on Information Forensics and Security, 2025. 8

    work page 2025

  14. [14]

    Exploring the devil in graph spectral domain for 3d point cloud attacks

    Qianjiang Hu, Daizong Liu, and Wei Hu. Exploring the devil in graph spectral domain for 3d point cloud attacks. InEu- ropean Conference on Computer Vision (ECCV), pages 229–

    work page

  15. [15]

    Pointcrt: Detecting backdoor in 3d point cloud via corrup- tion robustness

    Shengshan Hu, Wei Liu, Minghui Li, Yechao Zhang, Xiao- geng Liu, Xianlong Wang, Leo Yu Zhang, and Junhui Hou. Pointcrt: Detecting backdoor in 3d point cloud via corrup- tion robustness. InProceedings of the ACM International Conference on Multimedia (MM), pages 666–675, 2023. 3, 8

    work page 2023

  16. [16]

    Pointba: To- wards backdoor attacks in 3d point cloud

    Xinke Li, Zhirui Chen, Yue Zhao, Zekun Tong, Yabang Zhao, Andrew Lim, and Joey Tianyi Zhou. Pointba: To- wards backdoor attacks in 3d point cloud. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 16492–16501, 2021. 1, 3, 6

    work page 2021

  17. [17]

    Deep learning for lidar point clouds in autonomous driving: A review

    Ying Li, Lingfei Ma, Zilong Zhong, Fei Liu, Michael A Chapman, Dongpu Cao, and Jonathan Li. Deep learning for lidar point clouds in autonomous driving: A review. IEEE Transactions on Neural Networks and Learning Sys- tems (TNNLS), 32(8):3412–3432, 2020. 1

    work page 2020

  18. [18]

    Invisible backdoor attack with sample- specific triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample- specific triggers. InProceedings of the IEEE/CVF In- ternational Conference on Computer Vision (ICCV), pages 16463–16472, 2021. 2

    work page 2021

  19. [19]

    Untargeted backdoor watermark: Towards harm- less and stealthy dataset copyright protection.Advances in Neural Information Processing Systems (NeurIPS), 35: 13238–13250, 2022

    Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. Untargeted backdoor watermark: Towards harm- less and stealthy dataset copyright protection.Advances in Neural Information Processing Systems (NeurIPS), 35: 13238–13250, 2022. 3

    work page 2022

  20. [20]

    Back- door learning: A survey.IEEE Transactions on Neural Net- works and Learning Systems (TNNLS), 35(1):5–22, 2022

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Back- door learning: A survey.IEEE Transactions on Neural Net- works and Learning Systems (TNNLS), 35(1):5–22, 2022. 2

    work page 2022

  21. [21]

    Cross-modal driven object restoration for 3d point cloud backdoor defense.IEEE Transactions on Information Foren- sics and Security, 2025

    Jiawei Lian, Xia Du, Jianghua Liu, Le Hui, and Jian Yang. Cross-modal driven object restoration for 3d point cloud backdoor defense.IEEE Transactions on Information Foren- sics and Security, 2025. 3

    work page 2025

  22. [22]

    Daizong Liu, Wei Hu, and Xin Li. Point cloud attacks in graph spectral domain: When 3d geometry meets graph sig- nal processing.IEEE Transactions on Pattern Analysis and Machine Intelligence (PAMI), 46(5):3079–3095, 2023. 5

    work page 2023

  23. [23]

    Hide in thicket: Gener- ating imperceptible and rational adversarial perturbations on 3d point clouds

    Tianrui Lou, Xiaojun Jia, Jindong Gu, Li Liu, Siyuan Liang, Bangyan He, and Xiaochun Cao. Hide in thicket: Gener- ating imperceptible and rational adversarial perturbations on 3d point clouds. InProceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR), pages 24326–24335, 2024. 2, 4

    work page 2024

  24. [24]

    Wanet - impercepti- ble warping-based backdoor attack

    Tuan Anh Nguyen and Anh Tuan Tran. Wanet - impercepti- ble warping-based backdoor attack. InInternational Confer- ence on Learning Representations (ICLR), 2021. 8

    work page 2021

  25. [25]

    Stealthy and robust backdoor attack against 3d point clouds through additional point features

    Xiaoyang Ning, Qing Xie, Jinyu Xu, Wenbo Jiang, Jiachen Li, and Yanchun Ma. Stealthy and robust backdoor attack against 3d point clouds through additional point features. arXiv preprint arXiv:2412.07511, 2024. 3

    work page arXiv 2024

  26. [26]

    Pointnet: Deep learning on point sets for 3d classification and segmentation

    Charles R Qi, Hao Su, Kaichun Mo, and Leonidas J Guibas. Pointnet: Deep learning on point sets for 3d classification and segmentation. InProceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR), pages 652–660, 2017. 6

    work page 2017

  27. [27]

    Pointnet++: Deep hierarchical feature learning on point sets in a metric space.Advances in Neural Information Processing Systems (NeurIPS), 30, 2017

    Charles Ruizhongtai Qi, Li Yi, Hao Su, and Leonidas J Guibas. Pointnet++: Deep hierarchical feature learning on point sets in a metric space.Advances in Neural Information Processing Systems (NeurIPS), 30, 2017. 6

    work page 2017

  28. [28]

    Pointnext: Revisiting pointnet++ with improved training and scaling strategies.Advances in Neural Informa- tion Processing Systems (NeurIPS), 35:23192–23204, 2022

    Guocheng Qian, Yuchen Li, Houwen Peng, Jinjie Mai, Hasan Hammoud, Mohamed Elhoseiny, and Bernard Ghanem. Pointnext: Revisiting pointnet++ with improved training and scaling strategies.Advances in Neural Informa- tion Processing Systems (NeurIPS), 35:23192–23204, 2022. 6

    work page 2022

  29. [29]

    Backdoor attacks on self-supervised learning

    Aniruddha Saha, Ajinkya Tejankar, Soroush Abbasi Kooh- payegani, and Hamed Pirsiavash. Backdoor attacks on self-supervised learning. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 13337–13346, 2022. 3

    work page 2022

  30. [30]

    Grad-cam: Visual explanations from deep networks via gradient-based localization

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 618–626, 2017. 8

    work page 2017

  31. [31]

    David I Shuman, Sunil K Narang, Pascal Frossard, Antonio Ortega, and Pierre Vandergheynst. The emerging field of sig- nal processing on graphs: Extending high-dimensional data analysis to networks and other irregular domains.IEEE Sig- nal Processing Magazine (SPM), 30(3):83–98, 2013. 5

    work page 2013

  32. [32]

    A trigger-perceivable backdoor attack framework driven by image steganography.Pattern Recognition, 161: 111262, 2025

    Weixuan Tang, Jiahao Li, Yuan Rao, Zhili Zhou, and Fei Peng. A trigger-perceivable backdoor attack framework driven by image steganography.Pattern Recognition, 161: 111262, 2025. 2

    work page 2025

  33. [33]

    Multi-target label backdoor attacks on graph neural networks.Pattern Recognition, 152:110449, 2024

    Kaiyang Wang, Huaxin Deng, Yijia Xu, Zhonglin Liu, and Yong Fang. Multi-target label backdoor attacks on graph neural networks.Pattern Recognition, 152:110449, 2024. 1

    work page 2024

  34. [34]

    Dynamic graph cnn for learning on point clouds.ACM Transactions on Graphics (TOG), 38(5):1–12, 2019

    Yue Wang, Yongbin Sun, Ziwei Liu, Sanjay E Sarma, Michael M Bronstein, and Justin M Solomon. Dynamic graph cnn for learning on point clouds.ACM Transactions on Graphics (TOG), 38(5):1–12, 2019. 6

    work page 2019

  35. [35]

    Cheng Wei, Yang Wang, Kuofeng Gao, Shuo Shao, Yim- ing Li, Zhibo Wang, and Zhan Qin. Pointncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark.IEEE Transactions on In- formation Forensics and Security (TIFS), 2024. 3

    work page 2024

  36. [36]

    3d shapenets: A deep representation for volumetric shapes

    Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Lin- guang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3d shapenets: A deep representation for volumetric shapes. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), pages 1912–1920,

    work page 1912

  37. [37]

    A backdoor attack against 3d point cloud classifiers

    Zhen Xiang, David J Miller, Siheng Chen, Xi Li, and George Kesidis. A backdoor attack against 3d point cloud classifiers. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 7597–7607, 2021. 1, 3

    work page 2021

  38. [38]

    Detecting backdoor attacks against point cloud clas- sifiers

    Zhen Xiang, David J Miller, Siheng Chen, Xi Li, and George Kesidis. Detecting backdoor attacks against point cloud clas- sifiers. InICASSP 2022-2022 IEEE International Confer- ence on Acoustics, Speech and Signal Processing (ICASSP), pages 3159–3163. IEEE, 2022. 3

    work page 2022

  39. [39]

    Hiding imperceptible noise in curvature-aware patches for 3d point cloud attack

    Mingyu Yang, Daizong Liu, Keke Tang, Pan Zhou, Lixing Chen, and Junyang Chen. Hiding imperceptible noise in curvature-aware patches for 3d point cloud attack. InEuro- pean Conference on Computer Vision (ECCV), pages 431–

    work page

  40. [40]

    Not all prompts are secure: A switchable backdoor attack against pre-trained vision trans- fomers

    Sheng Yang, Jiawang Bai, Kuofeng Gao, Yong Yang, Yim- ing Li, and Shu-Tao Xia. Not all prompts are secure: A switchable backdoor attack against pre-trained vision trans- fomers. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24431–24441, 2024. 2

    work page 2024

  41. [41]

    A scalable active framework for region annotation in 3d shape collections.ACM Transactions on Graphics (TOG), 35(6):1–12, 2016

    Li Yi, Vladimir G Kim, Duygu Ceylan, I-Chao Shen, Mengyan Yan, Hao Su, Cewu Lu, Qixing Huang, Alla Shef- fer, and Leonidas Guibas. A scalable active framework for region annotation in 3d shape collections.ACM Transactions on Graphics (TOG), 35(6):1–12, 2016. 6

    work page 2016

  42. [42]

    3d medical point transformer: Introducing convolution to attention networks for medical point cloud analysis.arXiv preprint arXiv:2112.04863, 2021

    Jianhui Yu, Chaoyi Zhang, Heng Wang, Dingxin Zhang, Yang Song, Tiange Xiang, Dongnan Liu, and Weidong Cai. 3d medical point transformer: Introducing convolution to attention networks for medical point cloud analysis.arXiv preprint arXiv:2112.04863, 2021. 1

    work page arXiv 2021

  43. [43]

    Zenghui Yuan, Pan Zhou, Kai Zou, and Yu Cheng. You are catching my attention: Are vision transformers bad learners under backdoor attacks? InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24605–24615, 2023. 1, 2

    work page 2023

  44. [44]

    Point-m2ae: multi-scale masked autoencoders for hierarchical point cloud pre-training.Advances in Neural Information Processing Systems (NeurIPS), 35:27061–27074, 2022

    Renrui Zhang, Ziyu Guo, Peng Gao, Rongyao Fang, Bin Zhao, Dong Wang, Yu Qiao, and Hongsheng Li. Point-m2ae: multi-scale masked autoencoders for hierarchical point cloud pre-training.Advances in Neural Information Processing Systems (NeurIPS), 35:27061–27074, 2022. 4

    work page 2022

  45. [45]

    Tsba: A two-stage poison-only backdoor attack on visual object tracking.Pattern Recognition, page 112222,

    Yilang Zhang, Yanjun Pu, Jingzheng Li, Shuxin Zhao, and Bo Lang. Tsba: A two-stage poison-only backdoor attack on visual object tracking.Pattern Recognition, page 112222,

    work page

  46. [46]

    Negatively correlated ensemble against transfer adversarial attacks.Pat- tern Recognition, 161:111155, 2025

    Yunce Zhao, Wei Huang, Wei Liu, and Xin Yao. Negatively correlated ensemble against transfer adversarial attacks.Pat- tern Recognition, 161:111155, 2025. 2

    work page 2025

  47. [47]

    Pointcloud saliency maps

    Tianhang Zheng, Changyou Chen, Junsong Yuan, Bo Li, and Kui Ren. Pointcloud saliency maps. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 1598–1606, 2019. 8

    work page 2019

  48. [48]

    Dup-net: Denoiser and up- sampler network for 3d adversarial point clouds defense

    Hang Zhou, Kejiang Chen, Weiming Zhang, Han Fang, Wenbo Zhou, and Nenghai Yu. Dup-net: Denoiser and up- sampler network for 3d adversarial point clouds defense. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 1961–1970, 2019. 1, 3, 8

    work page 1961

  49. [49]

    Point cloud matters: Rethinking the impact of different observation spaces on robot learning.Ad- vances in Neural Information Processing Systems (NeurIPS), 37:77799–77830, 2025

    Haoyi Zhu, Yating Wang, Di Huang, Weicai Ye, Wanli Ouyang, and Tong He. Point cloud matters: Rethinking the impact of different observation spaces on robot learning.Ad- vances in Neural Information Processing Systems (NeurIPS), 37:77799–77830, 2025. 1

    work page 2025