Pith. sign in

REVIEW 4 major objections 6 minor 105 references

Generating Adversarial Point Clouds Using Diffusion Model

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that conditioning a 3D diffusion model's reverse process on latent codes from other classes turns black-box point cloud attacks into roughly 90% success rates.

desk verdict The core attack mechanism is missing: the only attack objective in the paper is geometric (DCD+MSE), with no classifier feedback, so the claimed 90% black-box ASR is not supported by the described method. read the letter →

arxiv 2507.21163 v1 pith:FYPFPHJW submitted 2025-07-25 cs.CR cs.AIcs.LG

Ruiyang Zhao , Bingbing Zhu , Chuxuan Tong , Xiaoyi Zhou , Xi Zheng This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords adversarialpointcloudsblack-boxattackdiffusionmodel3DclassificationtransferabilityChamferdistanceclouddefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that black-box adversarial attacks on 3D point cloud classifiers can become as effective as white-box attacks if the adversarial points are generated by a diffusion model rather than by querying the victim model. The central claim is that a reverse diffusion process, guided by latent codes taken from point clouds of other classes, can turn clean point clouds into misclassified ones while keeping the added points nearly imperceptible, reaching about 90% attack success in the black-box setting. This matters because black-box attacks are the realistic threat for LiDAR-based perception systems, and prior transfer-based black-box attacks on point clouds had noticeably lower success.

What carries the argument

The load-bearing mechanism is the reverse diffusion of a 3D point cloud diffusion model conditioned on class latents. The forward process adds Gaussian noise over steps, while the reverse process reconstructs a shape from noise under a conditioning latent; the adversarial twist is that the latent $z$ is extracted from point clouds of classes different from the clean input, so the denoiser generates a shape distribution carrying another class identity. A normalizing flow parameterizes the prior $p(z)$, and the loss $\mathcal{L}_{\mathrm{DIS}} = \lambda_1 \mathcal{L}_{\mathrm{DCD}} + \lambda_2 \mathcal{L}_{\mathrm{MSE}}$, combining Density-aware Chamfer Distance (a point-distance metric that weights matches by local density) with Mean Squared Error, is minimized during reverse steps to suppress outliers and keep the adversarial cloud close to the original shape.

What would settle it

Re-run the attack with the class-conditioning latents replaced by random latent vectors of the same shape while keeping the same diffusion model and losses; if attack success stays near 90%, the claimed conditioning mechanism is not the driver. Additionally, evaluate the method on a dataset outside the pretraining distribution, such as ScanObjectNN or real LiDAR segmentations, to test whether the latent-space transfer holds at all.

Watch

Extended reading notes

Core claim

On its own terms, the paper claims that adversarial point cloud generation can be reframed as a guided reverse diffusion process. Instead of perturbing points with the target classifier's gradients, the method encodes point clouds from other classes into latent representations and uses those latents to guide a pretrained 3D diffusion model to add adversarial points to a clean cloud. The resulting samples transfer to unseen classifiers without any access to the victim model's parameters or outputs, and the reported black-box attack success rate is about 90%, even after common input defenses such as SOR and SRS. The paper also reports lower Chamfer and Hausdorff distances than previous transfer-based attacks, meaning the perturbations are claimed to be both effective and visually small.

Load-bearing premise

The method assumes that latent codes extracted from point clouds of other classes, when fed into an off-the-shelf pretrained 3D diffusion model trained on unspecified data, will generate adversarial points that are both imperceptible and capable of misleading unseen classifiers without any fine-tuning or adaptation to the target model or dataset.

Editorial extensions

If this is right

  • Black-box transfer attacks on point cloud classifiers can reach roughly the same success rate as white-box attacks, without any gradient access to the victim model.
  • Adversarial examples generated from a surrogate model can generalize across different architectures such as PointNet++, CurveNet, and PointConv.
  • The generated adversarial point clouds survive simple input defenses like SOR and SRS, which previously degraded transfer-based attacks substantially.
  • Because the method is dataset-oriented rather than sample-oriented, a single diffusion pipeline can generate adversarial examples for many objects, lowering per-sample generation cost.
  • The attack's transferability and low geometric distortion suggest that safety testing of LiDAR perception should include diffusion-generated adversarial point clouds as a standard baseline.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct testable extension is to replace the class-conditioning latents with random Gaussian latents of the same dimensionality; if attack success remains near 90%, the class semantics are not doing the work and the effect comes from the diffusion prior's distribution shift.
  • The reported results likely depend on how well the pretrained 3D diffusion model's latent space covers the test distributions; evaluating on a dataset outside that distribution, such as real LiDAR segmentations or ScanObjectNN, would bound this dependence.
  • If the mechanism generalizes across object categories, the same latent-conditioned reverse diffusion could serve not only as an attack but as a general tool for probing classifier robustness on any 3D shape distribution.
  • The reverse diffusion's time cost currently limits online attacks, so a promising practical extension is distilling the reverse process or caching latent codes to bring generation closer to real-time.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a black-box adversarial attack for 3D point cloud classifiers. The method uses a pretrained 3D diffusion model: point clouds from classes other than the original are encoded into latent representations, and these latents condition the reverse diffusion process to generate adversarial point clouds. A density-aware Chamfer distance (DCD) and mean squared error (MSE) are combined as a loss to constrain the perturbation and improve imperceptibility. The authors report attack success rates around 90% against PointNet++, CurveNet, and PointConv on ModelNet40, robustness to SOR and SRS defenses, and preliminary ShapeNet results on three categories.

Significance. If the described method genuinely achieves high attack success rates in a black-box setting with imperceptible perturbations, it would be a useful contribution to 3D adversarial machine learning. The paper also provides a code link, which could support reproducibility if the method were fully specified. However, the current manuscript does not describe the central mechanism that is claimed to make the attack adversarial, and the experimental reporting is too incomplete to substantiate the headline claims.

major comments (4)
  1. [§3.3, §4.3–4.4, Eq. (8), Eq. (11)] The paper's central claim is that reverse diffusion actively crafts adversarial examples, but no classifier-dependent term appears in the attack objective. Eq. (8) minimizes L_DIS(x', x) and Eq. (11) defines L_DIS = λ1 L_DCD + λ2 L_MSE, both purely geometric distances. The 'Cls Model Query Update' block in Fig. 2 and the 'query update module' promised in §3.3 are never given an update rule or a loss involving target or surrogate predictions, logits, labels, or scores. As written, the method reduces to a DCD+MSE-constrained generative perturbation with no adversarial feedback, so the reported ~90% attack success rate is not attributable to the described algorithm. Please specify the query update rule, any use of model outputs, and the optimization procedure, or reframe the contribution accordingly.
  2. [Table 2] The row labeled '3D-Diffusion (DifA) Ours' is ambiguous: it appears to merge a generation-based baseline (DifA) with the proposed method. If 'Ours' is a distinct attack, the table does not provide a separate row with ASR/CD/HD for the proposed method against each target; if 'Ours' is intended as the DifA baseline, then the comparison against prior generation-based attacks is conflated. Please present the proposed method and the DifA baseline as separate rows with identical evaluation conditions.
  3. [§5.2, §5.5, Table 5, Table 6] The empirical support for the headline 'about 90%' is too thin. ShapeNet results in Table 5 report only three categories (Chair, Airplane, Bench) and the ablation in Table 6 uses only Chair; no error bars, standard deviations, or repeated runs are reported, with the text twice citing 'time constraints' (§5.2, §5.5). Given the large variation in ASR across those categories (64–93%), the abstract's claim of about 90% ASR and the transferability and robustness conclusions are not statistically supported. Please report full ShapeNet or a clearly described representative subset with variance, or temper the claims accordingly.
  4. [§4.2, §5.2] The method relies on a pretrained open-source 3D diffusion model 'trained on extensive point cloud data', but the model, its training data, and the encoder/normalizing-flow parameterization (Eq. (6)) are never identified or specified. Since the proposed mechanism—conditioning reverse diffusion on latent codes of other classes—depends on this latent space, the absence of model details, hyperparameters (T, α, λ1, λ2, optimization iterations, noise scale), and code-level configuration makes the experimental results irreproducible in practice. Please provide the exact pretrained checkpoint, the source of all latent codes, and complete hyperparameter settings.
minor comments (6)
  1. [§4.2, Eq. (6)] The change-of-variables formula uses A_α and then the text switches to F_α; the Jacobian determinant expression is not fully defined, and the 'transformer-based model A' is not otherwise described.
  2. [§5.2, §5.4] The text contains broken cross-references such as 'Table ??' and a mention of a 'Shape-Invariant (SI)' comparison that is not tied to any table or figure.
  3. [Table 6] The header of the HD column says 'HD↑', but lower Hausdorff distance is better; the arrow direction appears to be a typo.
  4. [Abstract, §6] The abstract and conclusion refer to attacking a 'target autopilot system', but no autonomous driving dataset or end-to-end system is used in the experiments; the claims should be aligned with the evaluated benchmarks.
  5. [§5.3] The text claims a 'lower time budget' compared to optimization-based attacks, but Table 2 does not report runtime; please add runtime measurements or remove the claim.
  6. [References] The reference list contains duplicate entries (e.g., [39] and [40] are the same paper) and several entries appear incomplete; a thorough proofread is needed.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation found; the reported ASR is an external empirical result, not a consequence of the attack loss.

full rationale

I found no circular step in the paper's derivation chain. The attack objective is defined in Eq. 8 as argmin L_Attack = L_DIS(x', x), and Eq. 11 expands L_DIS as lambda_1 * L_DCD + lambda_2 * L_MSE. Both terms are purely geometric fidelity losses between the clean cloud and the generated cloud; they contain no classifier logits, labels, surrogate gradients, or query responses. Therefore the reported black-box attack success rate is not an algebraic or definitional consequence of the optimization objective. ASR is measured against external classifiers (PointNet++, CurveNet, PointConv) under standard evaluation protocols, and the models are existing benchmark networks, not outputs of the proposed method. The choice of 2t DCD optimization iterations is selected from the ablation study in Section 5.5 based on success rate and distance metrics; this is hyperparameter tuning and is disclosed as such in the text, not a fitted parameter renamed as a prediction. The pretrained 3D diffusion model is described as an open-source external model trained on 'extensive point cloud data,' so the method does not rely on a self-citation chain for its central mechanism. The paper does contain a genuine internal-consistency gap: Section 3.3 states that 'we need a query update module to improve the adversarial nature of the noise points,' and Figure 2 shows a 'Cls Model Query Update' block, but no update rule or classifier-dependent loss is defined anywhere in Section 4. This makes the mechanism that would explain the claimed ASR incompletely specified and is a correctness risk, but it is not an instance of a prediction reducing by construction to its own inputs. The absence of a defined module, an unsupported compatibility assumption, or a mismatch between the abstract's 'about 90%' and Table 2's 86-87% are all concerns for correctness and completeness, not circularity. Accordingly, the circularity score is 0.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on a pretrained diffusion model and on the assumption that other-class latent conditioning yields effective and imperceptible perturbations. Several hyperparameters (DCD temperature, loss weights, noise scale, optimization count) are either unspecified or tuned to the evaluation metric. No new physical entities are introduced.

free parameters (5)
  • Diffusion steps T = 100
    Set for experiments; affects attack quality and speed, but no sensitivity analysis is reported except for optimization frequency.
  • DCD temperature alpha = not stated
    Appears in Eq. (9), controls density weighting; the value is not given.
  • Loss weights lambda1 and lambda2 = not stated
    Weights in Eq. (11) that combine DCD and MSE; not specified in the paper.
  • Number of DCD optimization iterations = 2t (benchmark)
    Chosen based on the attack success rate and distance metrics in Fig. 4, so it is tuned to the evaluation metric.
  • Diffusion noise scale = 0.05t
    Mentioned in Section 5.4 as the noise scale; no analysis of its effect is provided.
assumptions (5)
  • domain assumption Reverse diffusion conditioned on latent codes of other classes generates adversarial perturbations close to the clean input.
    This is the central mechanism; no proof or analysis is given, and it must hold for the method to work.
  • domain assumption The pretrained open-source 3D diffusion model provides a latent space suitable for ModelNet40, ShapeNet, and all target classifiers.
    The authors do not train or fine-tune the diffusion model; compatibility is assumed in Section 5.2 Baselines.
  • domain assumption DCD and MSE losses suppress outliers and preserve imperceptibility without harming attack success.
    Supported only by a partial ablation on the Chair category; the mechanism is not derived.
  • domain assumption Classifiers can be queried, and the query update module can steer generation using DCD and MSE.
    The query mechanism is not formally defined; the loss in Eq. (11) does not include model outputs.
  • standard math ASR computed over a test set correctly represents attack effectiveness.
    Standard definition in Eq. (12); no issue.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Generating Adversarial Point Clouds Using Diffusion Model." pith.science (2026). https://pith.science/paper/FYPFPHJW

@misc{pith2026250721163,
  author       = {Pith},
  title        = {Pith review of: Generating Adversarial Point Clouds Using Diffusion Model},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FYPFPHJW}},
  note         = {Machine review of arXiv:2507.21163}
}
read the original abstract

Adversarial attack methods for 3D point cloud classification reveal the vulnerabilities of point cloud recognition models. This vulnerability could lead to safety risks in critical applications that use deep learning models, such as autonomous vehicles. To uncover the deficiencies of these models, researchers can evaluate their security through adversarial attacks. However, most existing adversarial attack methods are based on white-box attacks. While these methods achieve high attack success rates and imperceptibility, their applicability in real-world scenarios is limited. Black-box attacks, which are more meaningful in real-world scenarios, often yield poor results. This paper proposes a novel black-box adversarial example generation method that utilizes a diffusion model to improve the attack success rate and imperceptibility in the black-box setting, without relying on the internal information of the point cloud classification model to generate adversarial samples. We use a 3D diffusion model to use the compressed features of the point cloud as prior knowledge to guide the reverse diffusion process to add adversarial points to clean examples. Subsequently, its reverse process is employed to transform the distribution of other categories into adversarial points, which are then added to the point cloud.

Figures

Figures reproduced from arXiv: 2507.21163 by the authors.

Figure 1
Figure 1. Comparison of various attack methods.. craft effective adversarial point clouds that mislead a target point cloud classifier 𝐹 by adding imperceptible noise 𝛿: 𝐹 (𝑋 + 𝛿) ≠ 𝑦. (5) In this setting, the adversary has limited access to the internal details of the target model 𝐹 , such as its parameters or outputs. Additionally, the generated adversarial samples are designed to be transferable, enabling them to deceive u… view at source ↗
Figure 2
Figure 2. The overview of the proposed method. the adversarial points we need [40], It can be expressed as: 𝑝(𝑧) = 𝑝𝑤  𝐴 −1 𝛼 (𝑧)  · 1 [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Effect of Eps on attack success rate (ASR) and Chamfer Dis￾tance(CD) 1 2 3 4 5 Optimization Frequency 0.0 0.2 0.4 0.6 0.8 Attack Success Rate(%) [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Fix the level of noise added by diffusion at each step and optimize the effect of the number of times on the performance of the attack, targeting PointNet++. 5.2 Experimental Settings Datasets. For a fair comparison, we evaluate AEs generated by our method on ShapeNet …
Figure 5
Figure 5. Figure 5: Comparison experiments of Chamfer Distance and Hausdorff Distance under different settings of the number of DCD optimizations for diffusion attacks, with the attack target network as PointNet++. 6 CONCLUSION The deceptive and imperceptible point cloud was successfully …

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

105 extracted references · 51 canonical work pages

  1. [3]

    Yulong Cao, Ningfei Wang, Chaowei Xiao, Dawei Yang, Jin Fang, Ruigang Yang, Qi Alfred Chen, Mingyan Liu, and Bo Li. 2021. Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks. In 2021 IEEE symposium on security and privacy (SP). IEEE, 176–194

    2021

  2. [22]

    Abdullah Hamdi, Sara Rojas, Ali Thabet, and Bernard Ghanem. 2020. Advpc: Transferable adversarial perturbations on 3d point clouds. In Computer Vision– ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceed- ings, Part XII 16 . Springer, 241–257

    2020

  3. [23]

    AdvPC: Transferable Adversarial Perturbations on 3D Point Clouds

    Abdullah Hamdi, Sara Rojas, Ali K. Thabet, and Bernard Ghanem. 2019. AdvPC: Transferable Adversarial Perturbations on 3D Point Clouds.ArXiv abs/1912.00461 (2019). https://api.semanticscholar.org/CorpusID:208527476

    work page Pith review arXiv 2019

  4. [40]

    Shitong Luo and Wei Hu. 2021. Diffusion probabilistic models for 3d point cloud generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2837–2845

    2021

  5. [59]

    arXiv preprint arXiv:2204.06125 1, 2 (2022), 3

    Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125 1, 2 (2022), 3

    arXiv 2022

  6. [60]

    Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli

  7. [1]

    Atrin Arya, Hanieh Naderi, and Shohreh Kasaei. 2023. Adversarial attack by limited point cloud surface modifications. In 2023 6th International Conference on Pattern Recognition and Image Analysis (IPRIA) . IEEE, 1–8

    2023

  8. [4]

    Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) . Ieee, 39–57

    2017

Show all 105 references
  1. [5]

    Angel X Chang, Thomas Funkhouser, Leonidas Guibas, Pat Hanrahan, Qixing Huang, Zimo Li, Silvio Savarese, Manolis Savva, Shuran Song, Hao Su, et al

  2. [6]

    Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. 2023. Diffusion models for imperceptible and transferable adversarial attack. arXiv preprint arXiv:2305.08192 (2023)

    2023 arXiv

  3. [7]

    Xi Chen, Diederik P Kingma, Tim Salimans, Yan Duan, Prafulla Dhariwal, John Schulman, Ilya Sutskever, and Pieter Abbeel. 2016. Variational lossy autoencoder. arXiv preprint arXiv:1611.02731 (2016)

    2016 arXiv

  4. [8]

    Xiaozhi Chen, Huimin Ma, Ji Wan, Bo Li, and Tian Xia. 2017. Multi-view 3d object detection network for autonomous driving. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition . 1907–1915

    2017

  5. [9]

    Zhiyu Chen, Feng Chen, Yiming Sun, Mingjie Wang, Shangdong Liu, and Yimu Ji

  6. [10]

    Wenda Chu, Linyi Li, and Bo Li. 2022. Tpc: Transformation-specific smoothing for point cloud models. In International Conference on Machine Learning . PMLR, 4035–4056

    2022

  7. [11]

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition . 9185–9193

    2018

  8. [12]

    Yinpeng Dong, Jun Zhu, Xiao-Shan Gao, et al . 2022. Isometric 3d adversarial examples in the physical world. Advances in Neural Information Processing Systems 35 (2022), 19716–19731

    2022

  9. [13]

    Yueqi Duan, Yu Zheng, Jiwen Lu, Jie Zhou, and Qi Tian. 2019. Structural relational reasoning of point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 949–958

    2019

  10. [14]

    Mahmood H Enad, Omar I Dallal Bashi, Shymaa Mohammed Jameel, Asaad A Alhasoon, Yasir Mahmood Al Kubaisi, and Husamuldeen K Hameed. 2024. Detect- ing and tracking a road-drivable area with three-dimensional point clouds and IoT for autonomous applications. Service Oriented Comp...

    2024

  11. [15]

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2018. Robust physical- world attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern r...

    2018

  12. [16]

    Zhongbin Fang, Xiangtai Li, Xia Li, Joachim M Buhmann, Chen Change Loy, and Mengyuan Liu. 2024. Explore in-context learning for 3d point cloud understand- ing. Advances in Neural Information Processing Systems 36 (2024)

    2024

  13. [17]

    Aleksey Golovinskiy, Vladimir G Kim, and Thomas Funkhouser. 2009. Shape- based recognition of 3D point clouds in urban environments. In 2009 IEEE 12th International Conference on Computer Vision . IEEE, 2154–2161

    2009

  14. [18]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  15. [19]

    Ankit Goyal, Hei Law, Bowei Liu, Alejandro Newell, and Jia Deng. 2021. Re- visiting point cloud shape classification with a simple and effective baseline. In International Conference on Machine Learning . PMLR, 3809–3820

    2021

  16. [20]

    Meng-Hao Guo, Jun-Xiong Cai, Zheng-Ning Liu, Tai-Jiang Mu, Ralph R Martin, and Shi-Min Hu. 2021. Pct: Point cloud transformer. Computational Visual Media 7 (2021), 187–199

    2021

  17. [21]

    Yulan Guo, Hanyun Wang, Qingyong Hu, Hao Liu, Li Liu, and Mohammed Bennamoun. 2020. Deep learning for 3d point clouds: A survey. IEEE transactions on pattern analysis and machine intelligence 43, 12 (2020), 4338–4364

    2020

  18. [24]

    Bangyan He, Jian Liu, Yiming Li, Siyuan Liang, Jingzhi Li, Xiaojun Jia, and Xiaochun Cao. 2023. Generating transferable 3d adversarial point cloud via random perturbation factorization. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 764–772

    2023

  19. [25]

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilistic models. Advances in neural information processing systems 33 (2020), 6840–6851

    2020

  20. [26]

    Qidong Huang, Xiaoyi Dong, Dongdong Chen, Hang Zhou, Weiming Zhang, and Nenghai Yu. 2022. Shape-invariant 3d adversarial point clouds. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 15335–15344

    2022

  21. [27]

    Tianxin Huang, Qingyao Liu, Xiangrui Zhao, Jun Chen, and Yong Liu. 2024. Learnable Chamfer Distance for point cloud reconstruction. Pattern Recognition Letters 178 (2024), 43–48

    2024

  22. [28]

    Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence , Vol. 34. 8018–8025

    2020

  23. [29]

    Jaeyeon Kim, Binh-Son Hua, Thanh Nguyen, and Sai-Kit Yeung. 2021. Minimal adversarial examples for deep learning on 3d point clouds. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 7797–7806

    2021

  24. [30]

    Kibok Lee, Zhuoyuan Chen, Xinchen Yan, Raquel Urtasun, and Ersin Yumer. 2020. Shapeadv: Generating shape-aware adversarial 3d point clouds. arXiv preprint arXiv:2005.11626 (2020)

    2020 arXiv

  25. [31]

    Peizheng Li, Jagdeep Singh, Han Cui, and Carlo Alberto Boano. 2024. BmmW: A DNN-based joint BLE and mmWave radar system for accurate 3D localization with goal-oriented communication. Pervasive and Mobile Computing (2024), 101944

    2024

  26. [32]

    Hongxin Lin, Zelin Xiao, Yang Tan, Hongyang Chao, and Shengyong Ding. 2019. Justlookup: One millisecond deep feature extraction for point clouds by lookup tables. In 2019 IEEE International Conference on Multimedia and Expo (ICME) . IEEE, 326–331

    2019

  27. [33]

    Daizong Liu and Wei Hu. 2022. Imperceptible transfer attack and defense on 3d point cloud classification. IEEE transactions on pattern analysis and machine intelligence 45, 4 (2022), 4727–4746

    2022

  28. [34]

    Daniel Liu, Ronald Yu, and Hao Su. 2019. Extending adversarial attacks and defenses to deep 3d point cloud classifiers. In 2019 IEEE International Conference on Image Processing (ICIP) . IEEE, 2279–2283

    2019

  29. [35]

    Daniel Liu, Ronald Yu, and Hao Su. 2020. Adversarial shape perturbations on 3d point clouds. In Computer Vision–ECCV 2020 Workshops: Glasgow, UK, August 23–28, 2020, Proceedings, Part I 16 . Springer, 88–104

    2020

  30. [36]

    Ye Liu, Yaya Cheng, Lianli Gao, Xianglong Liu, Qilong Zhang, and Jingkuan Song. 2022. Practical evaluation of adversarial robustness via adaptive auto attack. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 15105–15114

    2022

  31. [37]

    Yongcheng Liu, Bin Fan, Gaofeng Meng, Jiwen Lu, Shiming Xiang, and Chunhong Pan. 2019. Densepoint: Learning densely contextual representation for efficient point cloud processing. In Proceedings of the IEEE/CVF international conference on computer vision. 5239–5248

    2019

  32. [38]

    Tianrui Lou, Xiaojun Jia, Jindong Gu, Li Liu, Siyuan Liang, Bangyan He, and Xiaochun Cao. 2024. Hide in thicket: Generating imperceptible and rational adversarial perturbations on 3d point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni...

    2024

  33. [41]

    Zhaoyang Lyu, Jinyi Wang, Yuwei An, Ya Zhang, Dahua Lin, and Bo Dai. 2023. Controllable Mesh Generation Through Sparse Latent Point Diffusion Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 271–280

    2023

  34. [42]

    Chengcheng Ma, Weiliang Meng, Baoyuan Wu, Shibiao Xu, and Xiaopeng Zhang

  35. [43]

    Irfan Manisali, Okyanus Oral, and Figen S Oktem. 2024. Efficient physics-based learned reconstruction methods for real-time 3D near-field MIMO radar imaging. Digital Signal Processing 144 (2024), 104274

    2024

  36. [44]

    Luke Melas-Kyriazi, Christian Rupprecht, and Andrea Vedaldi. 2023. Pc2: Projection-conditioned point cloud diffusion for single-image 3d reconstruc- tion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 12923–12932

    2023

  37. [45]

    Shayan Mesdaghi, Reza PR Hasanzadeh, and Farrokh Janabi-Sharifi. 2024. Finger- hand Rehabilitation using DNN-based Gesture Recognition of Low-cost Webcam Images. In 2024 13th Iranian/3rd International Machine Vision and Image Processing Conference (MVIP). IEEE, 1–6

    2024

  38. [46]

    AAM Muzahid, Wanggen Wan, Ferdous Sohel, Lianyao Wu, and Li Hou. 2020. CurveNet: Curvature-based multitask learning deep networks for 3D object recognition. IEEE/CAA Journal of Automatica Sinica 8, 6 (2020), 1177–1187

    2020

  39. [47]

    Hanieh Naderi, Chinthaka Dinesh, Ivan V Bajic, and Shohreh Kasaei. 2022. Model- free prediction of adversarial drop points in 3D point clouds. arXiv preprint arXiv:2210.14164 (2022)

    2022 arXiv

  40. [48]

    Trung Nguyen, Quang-Hieu Pham, Tam Le, Tung Pham, Nhat Ho, and Binh- Son Hua. 2021. Point-set distances for learning representations of 3d point clouds. In Proceedings of the IEEE/CVF international conference on computer vision . 10478–10487

    2021

  41. [49]

    Alex Nichol, Heewoo Jun, Prafulla Dhariwal, Pamela Mishkin, and Mark Chen

  42. [50]

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. 2022. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460 (2022)

    2022 arXiv

  43. [51]

    Charles R Qi, Hao Su, Kaichun Mo, and Leonidas J Guibas. 2017. Pointnet: Deep learning on point sets for 3d classification and segmentation. In Proceedings of the IEEE conference on computer vision and pattern recognition . 652–660

    2017

  44. [52]

    Charles Ruizhongtai Qi, Li Yi, Hao Su, and Leonidas J Guibas. 2017. Pointnet++: Deep hierarchical feature learning on point sets in a metric space. Advances in neural information processing systems 30 (2017)

    2017

  45. [53]

    Shyam Nandan Rai, Fabio Cermelli, Dario Fontanel, Carlo Masone, and Barbara Caputo. 2023. Unmasking anomalies in road-scene segmentation. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 4037–4046

    2023

  46. [54]

    Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen

  47. [55]

    Satti RG Reddy, GP Saradhi Varma, and Rajya Lakshmi Davuluri. 2024. Deep neural network (dnn) mechanism for identification of diseased and healthy plant leaf images using computer vision. Annals of Data Science 11, 1 (2024), 243–272

    2024

  48. [56]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 10684–10695

    2022

  49. [57]

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. 2022. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural infor...

    2022

  50. [58]

    Jaydip Sen and Subhasis Dasgupta. 2023. Adversarial attacks on Image clas- sification models: FGSM and patch attacks and their impact. arXiv preprint arXiv:2307.02055 (2023)

    2023 arXiv

  51. [61]

    Jiachen Sun, Yulong Cao, Qi Alfred Chen, and Z Morley Mao. 2020. Towards robust{LiDAR-based} perception in autonomous driving: General black-box ad- versarial sensor attack and countermeasures. In29th USENIX Security Symposium (USENIX Security 20). 877–894

    2020

  52. [62]

    Jiachen Sun, Karl Koenig, Yulong Cao, Qi Alfred Chen, and Z Morley Mao. 2020. On adversarial robustness of 3d point cloud classification under adaptive attacks. arXiv preprint arXiv:2011.11922 (2020)

    2020 arXiv

  53. [63]

    Jiachen Sun, Qingzhao Zhang, Bhavya Kailkhura, Zhiding Yu, Chaowei Xiao, and Z Morley Mao. 2022. Modelnet40-c: A robustness benchmark for 3d point cloud recognition under corruption. In ICLR 2022 Workshop on Socially Responsible Machine Learning, Vol. 7

    2022

  54. [66]

    Keke Tang, Jianpeng Wu, Weilong Peng, Yawen Shi, Peng Song, Zhaoquan Gu, Zhihong Tian, and Wenping Wang. 2023. Deep Manifold Attack on Point Clouds via Parameter Plane Stretching. Proceedings of the AAAI Conference on Artificial Intelligence 37, 2 (Jun. 2023), 2420–2428. https...

    2023 doi

  55. [67]

    In International conference on machine learning

    Deep unsupervised learning using nonequilibrium thermodynamics. In International conference on machine learning . PMLR, 2256–2265

  56. [68]

    Tzungyu Tsai, Kaichen Yang, Tsung-Yi Ho, and Yier Jin. 2020. Robust adversarial objects against deep learning models. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 34. 954–962

    2020

  57. [69]

    James Tu, Mengye Ren, Sivabalan Manivasagam, Ming Liang, Bin Yang, Richard Du, Frank Cheng, and Raquel Urtasun. 2020. Physically realizable adversarial examples for lidar object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 1...

    2020

  58. [70]

    James Tu, Mengye Ren, Sivabalan Manivasagam, Ming Liang, Bin Yang, Richard Du, Frank Cheng, and Raquel Urtasun. 2020. Physically Realizable Adversarial Examples for LiDAR Object Detection. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 13713–13...

    2020

  59. [71]

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)

    2013 arXiv

  60. [72]

    Keke Tang, Jianpeng Wu, Weilong Peng, Yawen Shi, Peng Song, Zhaoquan Gu, Zhihong Tian, and Wenping Wang. 2023. Deep manifold attack on point clouds via parameter plane stretching. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 2420–2428

    2023

  61. [73]

    William Villegas-Ch, Angel Jaramillo-Alcázar, and Sergio Luján-Mora. 2024. Evaluating the Robustness of Deep Learning Models against Adversarial Attacks: An Analysis with FGSM, PGD and CW. Big Data and Cognitive Computing 8, 1 (2024), 8

    2024

  62. [74]

    Gusi Te, Wei Hu, Amin Zheng, and Zongming Guo. 2018. Rgcnn: Regularized graph cnn for point cloud segmentation. In Proceedings of the 26th ACM interna- tional conference on Multimedia . 746–754

    2018

  63. [75]

    Min Wang, Jiehui Jiang, Zhuangzhi Yan, Ian Alberts, Jingjie Ge, Huiwei Zhang, Chuantao Zuo, Jintai Yu, Axel Rominger, Kuangyu Shi, et al. 2020. Individual brain metabolic connectome indicator based on Kullback-Leibler Divergence Similarity Estimation predicts progression from ...

    2020

  64. [76]

    Yue Wang and Justin M Solomon. 2021. Object dgcnn: 3d object detection using dynamic graphs. Advances in Neural Information Processing Systems 34 (2021), 20745–20758

    2021

  65. [77]

    Yuxin Wen, Jiehong Lin, Ke Chen, CL Philip Chen, and Kui Jia. 2020. Geometry- aware generation of adversarial point clouds. IEEE Transactions on Pattern Analysis and Machine Intelligence 44, 6 (2020), 2984–2999

    2020

  66. [78]

    Arash Vahdat, Francis Williams, Zan Gojcic, Or Litany, Sanja Fidler, Karsten Kreis, et al. 2022. Lion: Latent point diffusion models for 3d shape generation. Advances in Neural Information Processing Systems 35 (2022), 10021–10039

    2022

  67. [79]

    A Vaswani. 2017. Attention is all you need. Advances in Neural Information Processing Systems (2017)

    2017

  68. [80]

    Tong Wu, Liang Pan, Junzhe Zhang, Tai Wang, Ziwei Liu, and Dahua Lin. 2021. Density-aware chamfer distance as a comprehensive metric for point cloud completion. arXiv preprint arXiv:2111.12702 (2021)

    2021 arXiv

  69. [81]

    Haiyan Wang and Yingli Tian. 2024. Sequential point clouds: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence (2024)

    2024

  70. [82]

    Chong Xiang, Charles R Qi, and Bo Li. 2019. Generating 3d adversarial point clouds. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 9136–9144

    2019

  71. [83]

    Tiange Xiang, Chaoyi Zhang, Yang Song, Jianhui Yu, and Weidong Cai. 2021. Walk in the cloud: Learning curves for point clouds shape analysis. InProceedings of the IEEE/CVF International Conference on Computer Vision . 915–924

    2021

  72. [84]

    Songsong Xiong, Georgios Tziafas, and Hamidreza Kasaei. 2023. Enhancing fine-grained 3D object recognition using hybrid multi-modal vision transformer- CNN models. In 2023 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 5751–5757

    2023

  73. [85]

    Matthew Wicker and Marta Kwiatkowska. 2019. Robustness of 3d deep learning in an adversarial setting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 11767–11775

    2019

  74. [86]

    Kevin Tirta Wijaya, Dong-Hee Paek, and Seung-Hyun Kong. 2024. Advanced feature learning on point clouds using multi-resolution features and learnable pooling. Remote Sensing 16, 11 (2024), 1835

    2024

  75. [87]

    Jiancheng Yang, Qiang Zhang, Rongyao Fang, Bingbing Ni, Jinxian Liu, and Qi Tian. 2019. Adversarial attack and defense on point sets. arXiv preprint arXiv:1902.10899 (2019)

    2019 arXiv

  76. [88]

    Wenxuan Wu, Zhongang Qi, and Li Fuxin. 2019. Pointconv: Deep convolu- tional networks on 3d point clouds. In Proceedings of the IEEE/CVF Conference on computer vision and pattern recognition . 9621–9630

    2019

  77. [89]

    Yaoqing Yang, Chen Feng, Yiru Shen, and Dong Tian. 2018. Foldingnet: Point cloud auto-encoder via deep grid deformation. In Proceedings of the IEEE confer- ence on computer vision and pattern recognition . 206–215

    2018

  78. [90]

    Hakan Yekta Yatbaz, Mehrdad Dianati, Konstantinos Koufos, and Roger Woodman

  79. [91]

    Haotian You, Yufang Lu, and Haihua Tang. 2023. Plant disease classification and adversarial attack using SimAM-EfficientNet and GP-MI-FGSM. Sustainability 15, 2 (2023), 1233

    2023

  80. [92]

    Mutian Xu, Runyu Ding, Hengshuang Zhao, and Xiaojuan Qi. 2021. Paconv: Position adaptive convolution with dynamic kernel assembling on point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 3173–3182

    2021

  81. [93]

    Mutian Xu, Runyu Ding, Hengshuang Zhao, and Xiaojuan Qi. 2021. PAConv: Position Adaptive Convolution with Dynamic Kernel Assembling on Point Clouds. In 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 3172–3181. https://doi.org/10.1109/CVPR46437.2021.00319

    2021

  82. [94]

    Dejun Zhang, Fazhi He, Soonhung Han, Lu Zou, Yiqi Wu, and Yilin Chen. 2017. An efficient approach to directly compute the exact Hausdorff distance for 3D point sets. Integrated Computer-Aided Engineering 24, 3 (2017), 261–277

    2017

  83. [95]

    Jiancheng Yang, Qiang Zhang, Bingbing Ni, Linguo Li, Jinxian Liu, Mengdie Zhou, and Qi Tian. 2019. Modeling point clouds with self-attention and gumbel subset sampling. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 3323–3332

    2019

  84. [96]

    Jianping Zhang, Wenwei Gu, Yizhan Huang, Zhihan Jiang, Weibin Wu, and Michael R Lyu. 2024. Curvature-Invariant Adversarial Attacks for 3D Point Clouds. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 38. 7142–7150

    2024

  85. [97]

    Hengshuang Zhao, Li Jiang, Chi-Wing Fu, and Jiaya Jia. 2019. Pointweb: Enhanc- ing local neighborhood features for point cloud processing. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 5565–5573

    2019

  86. [98]

    arXiv preprint arXiv:2404.07685 (2024)

    Run-time Monitoring of 3D Object Detection in Automated Driving Systems Using Early Layer Neural Activation Patterns. arXiv preprint arXiv:2404.07685 (2024)

    2024 arXiv

  87. [99]

    Boxuan Zhong, He Huang, and Edgar Lobaton. 2020. Reliable vision-based grasping target recognition for upper limb prostheses. IEEE Transactions on Cybernetics 52, 3 (2020), 1750–1762

    2020

  88. [100]

    Xuejing Yuan, Yuxuan Chen, Yue Zhao, Yunhui Long, Xiaokang Liu, Kai Chen, Shengzhi Zhang, Heqing Huang, Xiaofeng Wang, and Carl A Gunter. 2018. {CommanderSong}: A systematic approach for practical adversarial voice recog- nition. In 27th USENIX security symposium (USENIX secur...

    2018

  89. [101]

    Xiangyu Yue, Bichen Wu, Sanjit A Seshia, Kurt Keutzer, and Alberto L Sangiovanni-Vincentelli. 2018. A lidar point cloud generator: from a virtual world to autonomous driving. In Proceedings of the 2018 ACM on International Conference on Multimedia Retrieval . 458–464

    2018

  90. [103]

    Jinlai Zhang, Lyujie Chen, Binbin Liu, Bo Ouyang, Qizhi Xie, Jihong Zhu, Weiming Li, and Yanmei Meng. 2023. 3d adversarial attacks beyond point cloud.Information Sciences 633 (2023), 491–503

    2023

  91. [106]

    Tianhang Zheng, Changyou Chen, Junsong Yuan, Bo Li, and Kui Ren. 2019. Pointcloud saliency maps. In Proceedings of the IEEE/CVF international conference on computer vision. 1598–1606

    2019

  92. [108]

    Hang Zhou, Dongdong Chen, Jing Liao, Kejiang Chen, Xiaoyi Dong, Kunlin Liu, Weiming Zhang, Gang Hua, and Nenghai Yu. 2020. Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep net- works. In Proceedings of the IEEE/CVF Conference on C...

    2020

  93. [109]

    Yuan Zhuang, Qipeng Li, Yiwen Chen, Jianzhu Huai, Miao Li, Tianbing Ma, Yufei Tang, and Xinlian Liang. 2024. 3D-SeqMOS: A Novel Sequential 3D Moving Object Segmentation in Autonomous Driving. IEEE Transactions on Intelligent Transportation Systems (2024)

    2024

  94. [2015]

    arXiv preprint arXiv:1512.03012 (2015)

    Shapenet: An information-rich 3d model repository. arXiv preprint arXiv:1512.03012 (2015)

    2015 arXiv

  95. [2020]

    In Proceedings of the 28th ACM International Conference on Multimedia

    Efficient joint gradient based attack against sor defense for 3d point cloud classification. In Proceedings of the 28th ACM International Conference on Multimedia. 1819–1827

  96. [2022]

    arXiv preprint arXiv:2212.08751 (2022)

    Point-e: A system for generating 3d point clouds from complex prompts. arXiv preprint arXiv:2212.08751 (2022)

    2022 arXiv

  97. [2024]

    Computers & Security 139 (2024), 103539

    Local aggressive and physically realizable adversarial attacks on 3D point cloud. Computers & Security 139 (2024), 103539

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.