ADR: Interpretability-Guided Adversarial Perturbation Removal for 3D Point Clouds Via Geometric Completion
摘要
Deep learning models for 3D point clouds are highly susceptible to adversarial attacks, which can severely compromise their reliability in safety-critical applications. To address this, we propose ADR (Interpretability-Based Adversarial Perturbation Removal), a novel defense framework designed to effectively eliminate adversarial perturbations from 3D point clouds. ADR operates in a two-stage process: first, it leverages model interpretability through Grad-CAM to accurately identify and localize suspicious, high-attention regions likely manipulated by an attacker. Second, after removing these identified regions, a specially designed point cloud completion network is employed to meticulously restore the geometry and recover detailed structures. This completion network utilizes a multi-resolution encoder-decoder architecture, trained to reconstruct clean point cloud data with high fidelity. Extensive experiments on benchmark datasets like ModelNet40 and ShapeNet demonstrate that ADR significantly outperforms existing state-of-the-art defense methods against a wide array of adversarial attacks, substantially improving the classification accuracy of victim models on purified point clouds. Our results highlight the efficacy of combining model interpretability for precise attack localization with robust geometric completion for effective 3D adversarial defense.