Stealthy and Robust Backdoor Attack against 3D Point Clouds through Additional Point Features

Jiachen Li; Jinyu Xu; Qing Xie; Wenbo Jiang; Xiaoyang Ning; Yanchun Ma

REVIEW 4 major objections 5 minor 37 references

Stealthy and Robust Backdoor Attack against 3D Point Clouds through Additional Point Features

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SRBA embeds a backdoor in 3D point clouds by shifting only additional point features like reflection intensity, leaving geometry untouched, and reports attack success above 94% in all tested settings while surviving preprocessing defenses.

desk verdict First to use non-geometric point features as a backdoor channel; solid empirical attack, but the black-box search protocol is underspecified. read the letter →

arxiv 2412.07511 v2 pith:JOCTBVZQ submitted 2024-12-10 cs.CV

Xiaoyang Ning , Qing Xie , Jinyu Xu , Wenbo Jiang , Jiachen Li , Yanchun Ma This is my paper · ORCID

classification cs.CV

keywords backdoorattack3DpointcloudclassificationadditionalfeaturesuniformshifttriggerBayesianoptimizationpreprocessingdefensesstealthinessdatasetpoisoning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes SRBA, a backdoor attack on 3D point cloud classifiers that hides its trigger entirely in the additional point features—such as reflection intensity or face normal components—rather than in the point coordinates. The attack applies a uniform shift to these features on a subset of points, leaving the visible geometry unchanged, and claims this keeps poisoned samples visually identical to benign ones while still being learnable as a backdoor. Across six classifier architectures and three datasets, SRBA reports attack success above 94% in every configuration, and it keeps a near-perfect success rate when the strongest preprocessing defenses are applied together during training. If true, this means standard geometric defenses and human inspection cannot reliably neutralize this class of poisoning attack, making dataset poisoning a more serious threat for safety-critical point cloud systems.

What carries the argument

The load-bearing mechanism is the uniform feature shift $s$ acting on a subset $Q$ chosen by Farthest Point Sampling, combined with a processing function $G$ that keeps shifted features in a valid range. To automate the attack, the paper defines an objective $O(s) = \sum_i L(g'_\theta(\hat{X}^s_i), y_t) + \lambda \|s\|_1$, where $g'_\theta$ is a surrogate backdoored model trained briefly on the poisoned data, $L$ is the training loss on poisoned samples, $y_t$ is the target label, and the $\ell^1$ term penalizes large shifts. Bayesian optimization minimizes this objective under the claimed black-box assumption that the attacker does not know the victim model's architecture or parameters.

What would settle it

Optimize the uniform shift $s$ using a surrogate model of one architecture, then implant that same trigger into a victim model of a different architecture without any re-tuning, under the same poison rate of 5%; if the attack success rate falls below the claimed 94% in any of the six tested architectures, the black-box transferability premise that the surrogate represents the victim is falsified.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that a backdoor for 3D point cloud classifiers can be created without touching geometry at all. Because additional point features show class-specific distribution patterns, shifting those features on a few far-spread points is enough for a trained model to associate the resulting distribution with the attacker's target label. The trigger is a single uniform shift vector $s \in \mathbb{R}^c$ applied through $H(v_j, s) = (p_j, G(f_j + s))$, where $G$ clips or unitizes the shifted feature to a valid range. The paper reports that this trigger is robust to seven common preprocessing operations (outlier removal, rotation, rotation-3D, scaling, shift, dropout, jitter) applied simultaneously, and that it is not localized in 3D Grad-CAM heatmaps, because the affected points are scattered across the whole cloud.

Load-bearing premise

The load-bearing premise is that a surrogate backdoored model trained for a few epochs on the poisoned data reliably predicts how an unknown victim model will respond to the chosen shift, even though the paper does not specify how the surrogate is selected or show evidence that the trigger transfers across architectures.

Editorial extensions

If this is right

If SRBA is correct, point-cloud preprocessing pipelines that clean geometry—SOR, rotation, scaling, dropout, jitter—cannot be relied on to erase a backdoor, since the trigger lives outside geometry.
A poison rate near 2% already produces a significant attack, and shifting only about 100 points still yields roughly 80% attack success, so the data poisoning footprint is small.
A smaller shift trades only a few points of attack success for a much smaller Wasserstein distance between poisoned and benign samples, giving attackers a tunable stealthiness knob.
Attackers can use Bayesian optimization to find a shift automatically, removing the need to hand-design a trigger or know the victim model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper: if the mechanism generalizes, any per-point auxiliary feature—intensity, normals, color, even timestamps—becomes a possible backdoor channel, so a serious defense would need to monitor the distribution of every input feature, not just coordinates.
A testable extension is to measure trigger transfer across architectures: optimize $s$ with a surrogate, then implant the same trigger in different victim models; the paper's black-box framing implies this should hold, and the transfer curve would map how much the attack depends on knowing the victim.
Another extension is to study an informed defender who estimates $s$ from a small poisoned sample: the paper's adaptive-defense results with $w=1024$ show ASR falling to about 32–39%, so the conditions under which such estimation succeeds or fails are a directly researchable question.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The paper's core idea is simple and worth knowing: instead of modifying point cloud geometry to embed a backdoor trigger, shift the additional point features (normals, reflection intensity) by a uniform amount on a subset of points. Because common preprocessing defenses like SOR, rotation, and scaling target geometry, they leave the trigger intact. The authors report ASR >94% across six architectures and three datasets, and show the attack survives a combined preprocessing pipeline. That is a genuinely new trigger channel for 3D backdoors, and the first I have seen in this space.

What is solid: the empirical picture is consistent. Table 1 shows high ASR with little clean-accuracy loss. Table 4 is the strongest result—the attack holds up when all seven preprocessing operations are applied during training, while baselines collapse. The ablations are useful, especially Fig. 8, which shows that a broad range of shifts work. That tells me the effect is not a fragile artifact of one tuned trigger, which is a point in the paper's favor.

The soft spots are real but not fatal. The black-box trigger search is underspecified. Equation (2) evaluates candidate shifts on a surrogate g'_theta trained for "a few epochs," but the paper never states the surrogate's architecture, data split, or whether Table 1 uses one shared trigger or a per-architecture optimized one. If each victim architecture had its own same-architecture surrogate, the trigger selection is effectively white-box, and the transfer claim is not demonstrated. The stress-test also notes that the Eq. (2) objective may be optimizing the wrong quantity—the surrogate was trained with some initial trigger, and you evaluate a different shift's loss on it. That is a legitimate ambiguity. But given Fig. 8, the attack seems robust to the choice of shift, so this does not sink the paper; it limits the automated black-box contribution.

The stealthiness story is partially overstated. Table 3 shows the default trigger has a larger Wasserstein distance than several baselines; the authors point to a smaller trigger variant with ASR in the low-to-mid 90s. That is an honest trade-off, but it means "stealthy" needs a qualifier.

No code or data are released, and no error bars appear anywhere. That is a reproducibility gap worth a referee flag, not a reason to reject.

Overall, this is a legitimate, novel attack paper with a real result. I would send it to review. A referee should push on the surrogate protocol, ask for variance reporting, and clarify the stealthiness claim. The central mechanism—that shifting non-geometric features creates a robust backdoor—holds up.

Referee Report

4 major / 5 minor

Summary. The paper proposes SRBA, a backdoor attack against 3D point cloud classifiers. Instead of modifying spatial coordinates, SRBA applies a uniform shift to additional point features (e.g., face normals, reflection intensity) on a subset of points selected by farthest point sampling. The shift is optimized with Bayesian optimization using a surrogate model trained for a few epochs on a poisoned dataset. Experiments on ModelNet10, ModelNet40, and KITTI across six architectures report attack success rates above 94% in all-to-one and all-to-all settings, strong robustness to combined geometric preprocessing, and good visual and distributional stealthiness when a smaller trigger is used.

Significance. The core idea—embedding a backdoor in non-geometric point features—is novel and practically relevant, since additional point features are often processed by 3D DNNs but are rarely inspected by human operators or targeted by preprocessing defenses. If the reported results hold, SRBA would be a notable threat model that bypasses common defenses. The paper also contains a broad empirical comparison against four prior attacks, including robustness to SOR, rotation, scaling, dropout, and jitter, as well as STRIP, Spectral Signature, and Grad-CAM. The use of Bayesian optimization to automate trigger selection is a reasonable step toward a black-box setting, although the current description leaves important transferability questions open.

major comments (4)

[Searching the Optimal Trigger with BO, Eq. (2), Algorithm 1] The black-box trigger search is inadequately specified. The surrogate model g'_theta is described only as trained for 'a few epochs' on a poisoned dataset; no architecture, data split, training details, or relationship to the victim model are given. It is therefore unclear whether the reported ASRs in Table 1 were obtained with a single trigger shared across all architectures or with a separately optimized trigger per architecture. If the latter, the experiments do not demonstrate black-box transfer; if the former, the shared-trigger result should be stated explicitly and ideally isolated as an ablation. Without this information, the claim that BO provides an automated black-box trigger is not supported.
[Eq. (2) and Section 'Searching the Optimal Trigger with BO'] The objective O(s) evaluates a candidate shift s on a model g'_theta that was trained on a dataset poisoned with a potentially different initial trigger. As written, Eq. (2) measures the surrogate's loss on inputs perturbed with a new trigger s, not the loss that would result from training a model on data poisoned with s. Unless g'_theta is retrained for each evaluated s, the BO optimization may be optimizing a cross-trigger generalization quantity rather than the true backdoor loss. The paper should clarify the training procedure and, if the surrogate is trained once with a fixed trigger, justify why its reaction to unseen shifts is a valid proxy for the final attack success rate.
[Tables 1, 2, 4] All principal experiments report a single run per configuration, with no error bars, standard deviations, or seed variance. The claim that 'ASR exceeds 94% in all cases' (Abstract) and the small differences between SRBA and baselines (e.g., in Table 1) are not verifiable without repeated trials. I recommend reporting the mean and standard deviation over at least three seeds, or at minimum stating that the tables are representative and providing variance for key results.
[Table 3, 'Stealthiness Evaluation'] The stealthiness claim is weakened by the default trigger's Wasserstein distance: SRBA (Ours) reports WD values of 2.92, 2.89, and 2.53 on ModelNet10, ModelNet40, and KITTI, which are substantially larger than those of PointBA-O (0.19, 0.24, 1.17) and MirrorAttack (0.47, 0.59, 2.67). The paper acknowledges that a smaller trigger reduces WD but notes that ASR then drops to 93.75%, 92.07%, and 98.55%, i.e., below the 94% threshold on ModelNet10 and ModelNet40. The authors should either justify why the default trigger is preferred despite the worse distributional distance, or present the WD-ASR trade-off curve to support the 'stealthy and robust' characterization.

minor comments (5)

[Introduction and Related Works] Several citations appear as bare parenthetical year lists without author names or reference keys, e.g., '(2017; 2020; 2020; 2021; 2021; 2023)' and '(2017a; 2021; 2021)'. These should be expanded to proper citations.
[Section 'Searching the Optimal Trigger with BO'] There is a typo: 'automatically dentify' should be 'automatically identify'.
[Table 1 caption] The caption says 'bolded ans underlined'; 'ans' should be 'and'.
[Experiment Setup] The text states that 'More details of the experiment setup are provided in the appendix', but no appendix is included in the submitted manuscript. If the appendix exists, it should be part of the submission; otherwise the statement should be removed or the details provided.
[Figure 3] The pipeline figure uses numbered stages (1–4) that are not explicitly referenced in the body text, making it hard to map the diagram to the attack description. Consider adding a sentence that walks through the numbered stages.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SRBA's trigger is defined independently of its measured ASR, and the BO search is a genuine optimization against a surrogate loss rather than a fitted rename of the evaluation metric.

full rationale

The paper's load-bearing step is not a derivation but an empirical attack construction: the trigger is a uniform shift s applied to additional point features (Eq. 3), selected by Bayesian optimization against the surrogate objective O(s) in Eq. (2), and then evaluated by the independently measured attack success rate on poisoned test inputs. ASR is not defined as O(s) nor as the fitted s; Table 1 reports standard all-to-one ASR on poisoned samples, so the measurement is external to the BO objective. The BO objective includes the same loss used in training, but optimizing a parameter against a loss and then measuring generalization is a normal search procedure, not a circular reduction. The only self-citation (Color Backdoor, Jiang et al. 2023) is a motivational analogy, not load-bearing evidence; the central benchmarks are against external baselines on ModelNet/KITTI. Two non-circular rigor concerns should be noted: the surrogate-model transferability is underspecified in Algorithm 1 (the surrogate's architecture, data split, and whether Table 1 uses one shared trigger across victim models are not stated), and the abstract's claim of 'ASR exceeding 94% in all cases' is contradicted by the all-to-all results in Table 2 (e.g., PointNet 81.06 on KITTI). These are correctness and reproducibility concerns, not instances of circularity.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central mechanism rests on two unproven but empirically supported premises: that models use distributions of additional point features, and that a small proxy model predicts victim backdoor behavior. The trigger shift s, subset size w, BO balance weight, and poison rate are free choices of the attacker. No new entities are introduced.

free parameters (4)

Trigger shift s = Not reported numerically; selected by Bayesian optimization (Eq. 2)
The uniform shift applied to additional point features is the trigger; its value directly determines attack success and is optimized on a surrogate backdoored model.
Subset size w = Default not stated; ablation tests w = 200, 400, 600, 800, 1024
w controls how many points receive the shift. ASR rises with w and drops to around 80% at w=100, so this choice is load-bearing for the >94% ASR claim.
lambda (BO balance weight) = Not specified
The L1 penalty weight in Eq. (2) trades trigger magnitude against backdoor loss, shaping the Bayesian optimization objective, but no value is reported.
Poison rate eta = 0.05
The fraction of the training set that is poisoned; ASR increases with poison rate, and 0.05 is used for all main comparisons.

assumptions (5)

domain assumption 3D DNNs learn and rely on class-specific distributions of additional point features (e.g., normals, intensity) in addition to geometry.
Motivates why perturbing these distributions creates a usable trigger. Supported by Fig. 2 distribution plots and by the attack's empirical success, but not independently proven.
domain assumption The surrogate backdoored model g'_theta trained for a few epochs reliably indicates the final backdoor behavior of the victim model.
Invoked in 'Searching the Optimal Trigger with BO' and Algorithm 1. Based on a transferability heuristic from NAS literature (Zoph et al. 2018), not verified across architectures in the paper.
domain assumption Preprocessing operations and the data processing G act only on spatial coordinates or preserve the shifted additional features.
Needed for the robustness result. Holds for SOR, rotation, scaling, shift, dropout, and jitter as implemented, but would fail if defenders recompute normals after rotation or normalize intensity per cloud.
standard math Farthest Point Sampling selects a representative subset without altering geometry.
Used to choose Q in Eq. (3); standard algorithm from the point cloud literature.
standard math Bayesian optimization converges to a near-optimal trigger within the allocated evaluations.
Assumed by Algorithm 1; standard property of BO, but no convergence guarantee is given for this specific objective.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Stealthy and Robust Backdoor Attack against 3D Point Clouds through Additional Point Features." pith.science (2026). https://pith.science/paper/JOCTBVZQ

@misc{pith2026241207511,
  author       = {Pith},
  title        = {Pith review of: Stealthy and Robust Backdoor Attack against 3D Point Clouds through Additional Point Features},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JOCTBVZQ}},
  note         = {Machine review of arXiv:2412.07511}
}

read the original abstract

Recently, 3D backdoor attacks have posed a substantial threat to 3D Deep Neural Networks (3D DNNs) designed for 3D point clouds, which are extensively deployed in various security-critical applications. Although the existing 3D backdoor attacks achieved high attack performance, they remain vulnerable to preprocessing-based defenses (e.g., outlier removal and rotation augmentation) and are prone to detection by human inspection. In pursuit of a more challenging-to-defend and stealthy 3D backdoor attack, this paper introduces the Stealthy and Robust Backdoor Attack (SRBA), which ensures robustness and stealthiness through intentional design considerations. The key insight of our attack involves applying a uniform shift to the additional point features of point clouds (e.g., reflection intensity) widely utilized as part of inputs for 3D DNNs as the trigger. Without altering the geometric information of the point clouds, our attack ensures visual consistency between poisoned and benign samples, and demonstrate robustness against preprocessing-based defenses. In addition, to automate our attack, we employ Bayesian Optimization (BO) to identify the suitable trigger. Extensive experiments suggest that SRBA achieves an attack success rate (ASR) exceeding 94% in all cases, and significantly outperforms previous SOTA methods when multiple preprocessing operations are applied during training.

Figures

Figures reproduced from arXiv: 2412.07511 by the authors.

**Figure 2.** The distributions of additional point features for different categories of point clouds from the ModelNet10 and KITTI [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** The attack pipeline of our proposed SRBA. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: (a) Resistance results against STRIP. (b) Resis [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

**Figure 6.** Figure 6: Defense effect of adaptive defense during infer [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

**Figure 7.** Figure 7: Effect of the different target label yt, poison rate η and size w of Q. s in Reflection Intensity (KITTI) s in Face Normal Vector (ModelNet10) [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]

**Figure 8.** Figure 8: Effect of the different shift [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 18 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Bian, Y.; Tian, S.; and Liu, X. 2024. MirrorAttack: Backdoor Attack on 3D Point Cloud with a Distorting Mirror. arXiv preprint arXiv:2403.05847

work page Pith review arXiv 2024
[4]

Fan, L.; He, F.; Guo, Q.; Tang, W.; Hong, X.; and Li, B. 2022. Be careful with rotation: A uniform backdoor pattern for 3D shape. arXiv preprint arXiv:2211.16192

work page Pith review arXiv 2022
[5]

Fan, L.; He, F.; Si, T.; Tang, W.; and Li, B. 2024. Invisible Backdoor Attack against 3D Point Cloud Classifier in Graph Spectral Domain. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, 21072--21080

work page 2024
[6]

Feng, L.; Qian, Z.; Zhang, X.; and Li, S. 2024. Stealthy Backdoor Attacks On Deep Point Cloud Recognization Networks. The Computer Journal, 67(5): 1879--1891

work page 2024
[7]

Gao, K.; Bai, J.; Wu, B.; Ya, M.; and Xia, S.-T. 2023. Imperceptible and robust backdoor attack in 3d point cloud. IEEE Transactions on Information Forensics and Security, 19: 1267--1282

work page 2023
[8]

C.; and Nepal, S

Gao, Y.; Xu, C.; Wang, D.; Chen, S.; Ranasinghe, D. C.; and Nepal, S. 2019. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th annual computer security applications conference, 113--125

work page 2019

Show all 37 references

[9]

Geiger, A.; Lenz, P.; and Urtasun, R. 2012. Are we ready for autonomous driving? the kitti vision benchmark suite. In 2012 IEEE conference on computer vision and pattern recognition, 3354--3361. IEEE

2012
[10]

Gu, T.; Dolan-Gavitt, B.; and Garg, S. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733

2017 arXiv
[11]

Gu, T.; Liu, K.; Dolan-Gavitt, B.; and Garg, S. 2019. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7: 47230--47244

2019
[12]

R.; and Hu, S.-M

Guo, M.-H.; Cai, J.-X.; Liu, Z.-N.; Mu, T.-J.; Martin, R. R.; and Hu, S.-M. 2021. Pct: Point cloud transformer. Computational Visual Media, 7: 187--199

2021
[13]

Hammoud, H. A. A. K.; and Ghanem, B. 2021. Check your other door! Creating backdoor attacks in the frequency domain. arXiv preprint arXiv:2109.05507

2021 arXiv
[14]

Y.; and Hou, J

Hu, S.; Liu, W.; Li, M.; Zhang, Y.; Liu, X.; Wang, X.; Zhang, L. Y.; and Hou, J. 2023. Pointcrt: Detecting backdoor in 3d point cloud via corruption robustness. In Proceedings of the 31st ACM International Conference on Multimedia, 666--675

2023
[15]

Jiang, W.; Li, H.; Xu, G.; and Zhang, T. 2023. Color backdoor: A robust poisoning attack in color space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 8133--8142

2023
[16]

J.; and Kim, H

Kim, S.; Lee, S.; Hwang, D.; Lee, J.; Hwang, S. J.; and Kim, H. J. 2021. Point cloud augmentation with weighted local transformations. In Proceedings of the IEEE/CVF international conference on computer vision, 548--557

2021
[17]

Li, S.; Xue, M.; Zhao, B. Z. H.; Zhu, H.; and Zhang, X. 2020. Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 18(5): 2088--2105

2020
[18]

Li, X.; Chen, Z.; Zhao, Y.; Tong, Z.; Zhao, Y.; Lim, A.; and Zhou, J. T. 2021. Pointba: Towards backdoor attacks in 3d point cloud. In Proceedings of the IEEE/CVF international conference on computer vision, 16492--16501

2021
[19]

Li, Y.; Bu, R.; Sun, M.; Wu, W.; Di, X.; and Chen, B. 2018. Pointcnn: Convolution on x-transformed points. Advances in neural information processing systems, 31

2018
[20]

Nguyen, T.; Pham, Q.-H.; Le, T.; Pham, T.; Ho, N.; and Hua, B.-S. 2021. Point-set distances for learning representations of 3d point clouds. In Proceedings of the IEEE/CVF international conference on computer vision, 10478--10487

2021
[21]

R.; Su, H.; Mo, K.; and Guibas, L

Qi, C. R.; Su, H.; Mo, K.; and Guibas, L. J. 2017 a . Pointnet: Deep learning on point sets for 3d classification and segmentation. In Proceedings of the IEEE conference on computer vision and pattern recognition, 652--660

2017
[22]

R.; Yi, L.; Su, H.; and Guibas, L

Qi, C. R.; Yi, L.; Su, H.; and Guibas, L. J. 2017 b . Pointnet++: Deep hierarchical feature learning on point sets in a metric space. Advances in neural information processing systems, 30

2017
[23]

R.; Cogswell, M.; Das, A.; Vedantam, R.; Parikh, D.; and Batra, D

Selvaraju, R. R.; Cogswell, M.; Das, A.; Vedantam, R.; Parikh, D.; and Batra, D. 2017. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on computer vision, 618--626

2017
[24]

P.; and De Freitas, N

Shahriari, B.; Swersky, K.; Wang, Z.; Adams, R. P.; and De Freitas, N. 2015. Taking the human out of the loop: A review of Bayesian optimization. Proceedings of the IEEE, 104(1): 148--175

2015
[25]

Tran, B.; Li, J.; and Madry, A. 2018. Spectral signatures in backdoor attacks. Advances in neural information processing systems, 31

2018
[26]

Wang, T.; Yao, Y.; Xu, F.; An, S.; Tong, H.; and Wang, T. 2021. Backdoor attack through frequency domain. arXiv preprint arXiv:2111.10991

2021 arXiv
[27]

E.; Bronstein, M

Wang, Y.; Sun, Y.; Liu, Z.; Sarma, S. E.; Bronstein, M. M.; and Solomon, J. M. 2019. Dynamic graph cnn for learning on point clouds. ACM Transactions on Graphics (tog), 38(5): 1--12

2019
[28]

Wu, Z.; Song, S.; Khosla, A.; Yu, F.; Zhang, L.; Tang, X.; and Xiao, J. 2015. 3d shapenets: A deep representation for volumetric shapes. In Proceedings of the IEEE conference on computer vision and pattern recognition, 1912--1920

2015
[29]

J.; Chen, S.; Li, X.; and Kesidis, G

Xiang, Z.; Miller, D. J.; Chen, S.; Li, X.; and Kesidis, G. 2021. A backdoor attack against 3d point cloud classifiers. In Proceedings of the IEEE/CVF international conference on computer vision, 7597--7607

2021
[30]

Yang, Y.; Feng, C.; Shen, Y.; and Tian, D. 2018. Foldingnet: Point cloud auto-encoder via deep grid deformation. In Proceedings of the IEEE conference on computer vision and pattern recognition, 206--215

2018
[31]

Yang, Z.; Sun, Y.; Liu, S.; and Jia, J. 2020. 3dssd: Point-based 3d single stage object detector. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 11040--11048

2020
[32]

Yin, T.; Zhou, X.; and Krahenbuhl, P. 2021. Center-based 3d object detection and tracking. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 11784--11793

2021
[33]

H.; and Koltun, V

Zhao, H.; Jiang, L.; Jia, J.; Torr, P. H.; and Koltun, V. 2021. Point transformer. In Proceedings of the IEEE/CVF international conference on computer vision, 16259--16268

2021
[34]

C.; Zhu, S.; and Miller, D

Zhong, H.; Liao, C.; Squicciarini, A. C.; Zhu, S.; and Miller, D. 2020. Backdoor embedding in convolutional neural network models via invisible perturbation. In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy, 97--108

2020
[35]

Zhou, H.; Chen, K.; Zhang, W.; Fang, H.; Zhou, W.; and Yu, N. 2019. Dup-net: Denoiser and upsampler network for 3d adversarial point clouds defense. In Proceedings of the IEEE/CVF international conference on computer vision, 1961--1970

2019
[36]

Zhou, Y.; and Tuzel, O. 2018. Voxelnet: End-to-end learning for point cloud based 3d object detection. In Proceedings of the IEEE conference on computer vision and pattern recognition, 4490--4499

2018
[37]

Zoph, B.; Vasudevan, V.; Shlens, J.; and Le, Q. V. 2018. Learning transferable architectures for scalable image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, 8697--8710

2018

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Bian, Y.; Tian, S.; and Liu, X. 2024. MirrorAttack: Backdoor Attack on 3D Point Cloud with a Distorting Mirror. arXiv preprint arXiv:2403.05847

work page Pith review arXiv 2024

[4] [4]

Fan, L.; He, F.; Guo, Q.; Tang, W.; Hong, X.; and Li, B. 2022. Be careful with rotation: A uniform backdoor pattern for 3D shape. arXiv preprint arXiv:2211.16192

work page Pith review arXiv 2022

[5] [5]

Fan, L.; He, F.; Si, T.; Tang, W.; and Li, B. 2024. Invisible Backdoor Attack against 3D Point Cloud Classifier in Graph Spectral Domain. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, 21072--21080

work page 2024

[6] [6]

Feng, L.; Qian, Z.; Zhang, X.; and Li, S. 2024. Stealthy Backdoor Attacks On Deep Point Cloud Recognization Networks. The Computer Journal, 67(5): 1879--1891

work page 2024

[7] [7]

Gao, K.; Bai, J.; Wu, B.; Ya, M.; and Xia, S.-T. 2023. Imperceptible and robust backdoor attack in 3d point cloud. IEEE Transactions on Information Forensics and Security, 19: 1267--1282

work page 2023

[8] [8]

C.; and Nepal, S

Gao, Y.; Xu, C.; Wang, D.; Chen, S.; Ranasinghe, D. C.; and Nepal, S. 2019. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th annual computer security applications conference, 113--125

work page 2019