Improving the Transferability of Point Cloud Attack via Spectral-Aware Admix and Optimization Designs
摘要
Adversarial attacks on deep learning models for point clouds pose significant risks, especially in critical fields like autonomous driving and robotics. Traditional 3D attacks are generally deployed in a simple white-box environment that requires prior knowledge of complicated model details, however, real-world scenarios often involve black-box settings with only classifier outputs accessible. To this end, this paper attempts to address the challenge of black-box attacks on 3D models by proposing a transfer-based approach, where we first create adversarial examples using a white-box surrogate model and then transfer them to target black-box models. To enhance transferability, we introduce a novel Spectral-aware Admix with Augmented Optimization (SAAO) method. Unlike traditional 2D Admix strategies that add pixel-wise perturbations, our approach exploits a more 3D-suitable spectral-aware fusion for point cloud processing. By deploying Graph Fourier Transform (GFT) in the spectral domain, we avoid disrupting point cloud geometric contexts. We optimize the selection of perturbations and learning weights using spectral-aware weighted Admix, then generate adversarial spectral features and convert them back to the data domain via the inverse GFT. Our experiments demonstrate that the proposed SAAO attack significantly improves adversarial transferability compared to existing 3D attack methods, achieving higher attack success rates in black-box scenarios.