{"id":"93ff4441-ab1f-4744-9341-54325c3cf8ac","arxiv_id":"1908.06062","paper_version":3,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Three shape-deforming adversarial attacks on 3D point cloud classifiers maintain high success rates against point-removal defenses.","lead":"This paper introduces three new attacks that deform the shape of 3D point clouds, such as adding stick-like features or smoothly pulling points toward sink points. These shape-based attacks keep high success rates even when defenses remove outlier or salient points, unlike small imperceptible perturbations.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Alpha-shape surface reconstruction is an unvalidated load-bearing step for the perturbation-resampling and adversarial-sticks attacks; if S* is inaccurate, these attacks are not continuous surface deformations and the defense-robustness claim loses its stated mechanism.","rationale":"The reader's weakest-assumption analysis identifies alpha-shape triangulation as the load-bearing step; my read agrees. The paper's central empirical result is that shape attacks remain effective after point-removal defenses, and the explanatory mechanism is continuous, outlier-free deformation. Perturbation resampling reconstructs S* from the perturbed cloud, and adversarial sticks reconstruct the benign surface for projection, so both inherit any triangulation error. The Figure 2 caption concedes visible artifacts from triangulation limitations, but the paper never quantifies how often the reconstruction is wrong or how far the resampled points drift from the true surface. This matters because if the reconstructed surface is inaccurate, the attacks may be better described as dense noisy perturbations, and the defense comparison would no longer support the conceptual claim about shape deformation. The proposed test is concrete: compare adversarial points against the ground-truth meshes and rerun the defense evaluation using the true mesh in place of alpha shape. If the success rates are stable, the concern is resolved and the empirical claim stands; if they drop, the paper needs additional validation or a qualified claim. This does not change the reader's conditional verdict, since the requirement for surface-fidelity validation is already implicit in the reader's condition. I also note the paper provides source code and a clear experimental protocol, which are positive reproducibility signals, but the absence of surface-fidelity and error-bar reporting still warrants the conditional status.","tokens_in":12871,"tokens_out":11713,"duration_ms":118041,"concrete_test":"Use the ground-truth meshes available for ModelNet40 to measure surface fidelity of the adversarial point clouds produced by perturbation resampling and adversarial sticks. For each test object, compute the distance from every point in the adversarial cloud to the true mesh surface and report the fraction of points whose distance exceeds a small threshold, e.g., 1% of the bounding-box diameter. Then rerun the Table 2 evaluation with the alpha-shape surface replaced by the ground-truth mesh for the projection/resampling steps. If success rates under outlier and salient removal remain essentially unchanged, the triangulation assumption is not load-bearing; if they drop materially, the central claim must be narrowed or the attacks revalidated with a more accurate reconstruction.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that some shape attacks survive point-removal defenses because they produce continuous, outlier-free deformations rather than sparse outlier perturbations. This mechanism is load-bearing: the defenses in Section 2.2 are specifically outlier and saliency filters, and the paper's interpretation of Table 2 is that shape attacks pass these filters because they contain no outliers. Perturbation resampling (Section 6.1) and adversarial sticks (Section 6.2) both depend on reconstructing a surface from the point cloud via alpha-shape triangulation, and the paper supplies no validation that the reconstructed surface is accurate. If alpha shape produces spurious triangles, holes, or interior chords on thin or complex ModelNet40 shapes, then the resampled points will not lie on a clean surface; the attack then degenerates into dense noise plus resampling, and the point-removal comparison no longer tests shape deformation. The paper's own Figure 2 caption admits that 'some areas are noticeably missing points in the perturbation resampling adversarial examples, which is due to limitations in the triangulation procedure on a fixed number of points.' Without a surface-fidelity metric, the aggregate success rates in Table 2 cannot distinguish a genuine continuous shape attack from a noisy attack that happens to survive these specific filters.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies adversarial attacks on 3D point cloud classifiers and distinguishes two attack families: distributional attacks, which add small imperceptible perturbations to all points, and shape attacks, which deform the object surface in a focused and more perceptible way. The authors propose three shape attacks: perturbation resampling, which resamples low-saliency points onto an alpha-shape estimated surface; adversarial sticks, which creates protruding line-segment features on the surface; and adversarial sinks, which smoothly deforms the point cloud through learnable sink points. Experiments on ModelNet40 with PointNet, PointNet++, and DGCNN evaluate the attacks under random point removal, outlier removal, and salient point removal defenses. The main empirical claim, driven primarily by Table 2 and Figure 3, is that the shape attacks—especially adversarial sinks—maintain high success rates against these point-removal defenses, whereas distributional attacks degrade substantially. Source code is available.","tokens_in":13178,"tokens_out":8255,"duration_ms":75478,"significance":"If the results hold, the paper makes a useful contribution by identifying a class of shape-deforming adversarial perturbations that can bypass point-removal defenses, which were previously shown to be effective against small distributional attacks. The open-source implementation, evaluation across three architectures and three defenses, and the introduction of a fully differentiable, surface-free attack (adversarial sinks) are notable strengths. The paper also usefully articulates a perceptibility-robustness trade-off for 3D point cloud attacks. However, the strength of the conclusions is tempered by the lack of quantitative validation of the alpha-shape reconstruction used by two of the three attacks, by the absence of distortion metrics when comparing attacks with very different perceptibility budgets, and by evaluation-methodology concerns such as possible test-set tuning and missing error bars.","major_comments":[{"comment":"The perturbation resampling and adversarial sticks attacks depend on an alpha-shape triangulation to reconstruct the surface S* or S from a finite point cloud, but the paper provides no quantitative validation of this reconstruction. The Figure 2 caption itself concedes that \"some areas are noticeably missing points in the perturbation resampling adversarial examples, which is due to limitations in the triangulation procedure on a fixed number of points.\" If the reconstructed surface is inaccurate, the resampled points may not lie on a clean continuous surface, and the claimed mechanism for defense robustness—that the attacks produce continuous, outlier-free deformations—is not established for these two attacks. Please add surface-fidelity metrics (e.g., distance between resampled points and the original mesh, or an ablation using the ground-truth mesh instead of the alpha-shape estimate) or otherwise demonstrate that the attacks' success does not stem from triangulation artifacts.","section":"Section 6.1 and 6.2, Figure 2 caption"},{"comment":"The success rates of the shape attacks and the distributional baselines are compared without reporting the actual perceptibility of the generated adversarial examples. Shape attacks are described as intentionally larger and more localized than distributional attacks, so their higher robustness under point removal is expected from their larger perturbation budget; the paper even admits in Section 7.1 that \"directly comparing the attacks that use binary search with those that do not is unfair,\" yet Table 2 is presented as a head-to-head comparison. Please report per-attack distortion metrics (Chamfer distance, Hausdorff distance, and L2 norm relative to the benign cloud) and provide a success-versus-distortion analysis so that the robustness claim is not attributable solely to a larger perceptibility budget.","section":"Section 7.1 and Table 2"},{"comment":"The hyperparameters for all attacks were \"determined through rudimentary grid search,\" and the test split of ModelNet40 is used for evaluation, with no indication that a separate validation set was used for tuning. This creates a risk that the reported success rates are optimistically biased through test-set overfitting. Please clarify whether hyperparameters were tuned on the test set; if so, re-tune on a validation split and report test results. Additionally, Table 2 and Figure 3 report single point estimates without confidence intervals, and for several configurations the differences between attacks are small (e.g., PointNet with outlier removal: perturbation resampling 81.6%, sticks 86.8%, sinks 84.7%), so error bars or confidence intervals should be provided to support the comparative claims.","section":"Section 7.1"}],"minor_comments":[{"comment":"The opening sentence, \"Due to resampling and projection operations used in the adversarial sinks attack that make optimization difficult,\" appears to describe the adversarial sticks or perturbation resampling attacks rather than adversarial sinks; please reword to avoid confusion.","section":"Section 6.3"},{"comment":"The set-builder expression has an unmatched parenthesis and uses the symbol 'epsilon' both for the defense threshold and for the attack perturbation bound; please introduce a different symbol for the defense threshold.","section":"Equation (2)"},{"comment":"The success rate is not explicitly defined; please state that it is the fraction of correctly classified benign examples that the attack misclassifies, and report the number of examples used per architecture.","section":"Table 2"},{"comment":"The sentence \"we will show the effect of changing some of them in our experiments\" is vague; Figure 4 and Table 3 only cover a subset of attacks and defenses, so please state which hyperparameters are varied and which are held fixed.","section":"Section 7.1"},{"comment":"Reference [16] is cited both as an attack and as the source of the defenses evaluated later; the related-work discussion would be clearer if this dual role were stated explicitly.","section":"Section 2.1"}],"recommendation":"major_revision","confidential_remarks":"The evaluation relies heavily on defenses from the authors' own prior work [16], and the gradient projection baseline is also their own variant. This is not by itself a flaw, but independent reimplementation of the defenses and inclusion of at least one defense from another group would strengthen the paper. The open-source code is a positive signal. The editor may also consider whether the title and abstract overclaim relative to the fact that only point-removal defenses are tested."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nYou should know this paper before you write your next related-work section on 3D adversarial robustness: it shows that shape-deforming attacks (stretching the surface, adding stick-like protrusions, pulling points toward 'sinks') are substantially more robust to point-removal defenses than the usual Lp or Chamfer perturbation attacks. The central table (Table 2) is convincing on that point across PointNet, PointNet++, and DGCNN. The most novel and cleanest attack is adversarial sinks, which deforms the point cloud by moving points toward a set of learned sink points with a radial basis falloff; it doesn't need surface reconstruction and still beats the distributional baselines under outlier and saliency removal by a wide margin (e.g., 84.7% vs 46.9% on defended PointNet). That alone is the key finding.\n\nWhat's new: the three attack families are new as far as the cited literature goes, and the paper properly credits parallel work [26] for the resampling idea. The evaluation is unusually broad: three architectures, three defenses, and ablations on the number of resampled/perturbed points that show the attacks smoothly interpolate between distributional and shape regimes. The code is public.\n\nSoft spots, in order of real impact:\n\n1. The alpha-shape reconstruction is load-bearing for perturbation resampling and adversarial sticks, and the paper admits in the Figure 2 caption that 'some areas are noticeably missing points... due to limitations in the triangulation procedure.' Without a surface-fidelity metric, we can't tell whether the resample and stick attacks are actually deforming the surface or just producing dense noise that happens to survive these filters. This is a genuine gap, but it's not fatal: the sinks attack doesn't use alpha shape, so the main claim that 'some' shape attacks beat point-removal defenses survives.\n\n2. No error bars anywhere in the tables. The differences between attack success rates are often small (e.g., 81.6 vs 86.8), and without variance estimates I can't tell which are significant. This should be fixed before acceptance.\n\n3. Hyperparameters were tuned on the same test set (rudimentary grid search, no held-out validation). This inflates all numbers equally, so it's a fair comparison only in a loose sense, and it weakens the absolute claims.\n\n4. The only point-removal defenses tested are from the authors' own prior paper [16] plus random dropout. The related work cites [36], an independent outlier-guided removal defense, but it is never evaluated. That would have been the obvious check for circularity.\n\nWho is this for: anyone working on 3D point cloud robustness, attack generation, or defenses against physical-world manipulation. It deserves a serious referee: the core finding is real and the limitations are fixable in revision. I would not desk-reject this.\n\nRecommendation: send it to peer review with a request for error bars, an independent defense, and a surface-fidelity validation for the alpha-shape-dependent attacks.","headline":"Shape-deforming attacks, especially adversarial sinks, genuinely beat point-removal defenses in this paper; the alpha-shape reliance in two of the three attacks is a real but fixable gap, and the core finding deserves peer review.","tokens_in":13665,"tokens_out":2869,"would_cite":true,"duration_ms":26668,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"By deforming the surface of a 3D point cloud instead of nudging isolated points, three new attacks keep high success rates even after outlier-removal and salient-point-removal defenses, making point-removal preprocessing insufficient…","keywords":["adversarial attacks","adversarial defenses","3D point clouds","shape attacks","point-removal defenses","PointNet","ModelNet40","deep learning robustness"],"falsifier":"Run perturbation resampling and adversarial sticks on thin or open shapes—like a hollow tube or a flat sheet sampled with 1,024 points—and apply outlier removal; if alpha-shape reconstruction fails, the resampled points will scatter off the true surface and the attack success rate should fall to the level of ordinary point-shift attacks.","tokens_in":12679,"feed_emoji":"🎯","tokens_out":8378,"duration_ms":79811,"temperature":0.7,"pith_summary":"This paper asks whether adversarial examples for 3D point-cloud classifiers can be made by changing the shape of an object rather than by nudging individual points. It proposes three shape attacks—perturbation resampling, adversarial sticks, and adversarial sinks—that deform the surface continuously or attach new features, and it reports that these attacks remain highly successful after point-removal defenses that defeat conventional small-perturbation attacks. If the finding holds, point-removal preprocessing used in real LiDAR or RGB-D pipelines is not sufficient protection, and defenses must target continuous shape deformation instead.","feed_headline":"Deforming shapes defeats point-removal defenses","feed_subtitle":"Three new attacks keep high success against outlier and saliency filters that stopped earlier point-shift attacks.","key_machinery":"The load-bearing objects are three deformation mechanisms plus one surface estimate. The paper estimates the underlying surface $\\mathcal{S}$ (or the adversarial surface $\\mathcal{S}^*$) of a point cloud using $\\alpha$-shape reconstruction from a 3D Delaunay triangulation; this triangulated surface is what connects perturbed points into a continuous shape. Perturbation resampling maximizes a minimum pairwise-distance objective and uses farthest-point sampling to redistribute resampled points on the deformed surface. Adversarial sticks optimize vectors for a few perturbed anchor points, projects them back onto the benign surface, and resamples points along the resulting line-segment features. Adversarial sinks deform the entire cloud by shifting every point toward movable sink points through a Gaussian radial basis function, with no surface reconstruction at all.","core_discovery":"The paper's central claim is that shape-level perturbations form a distinct attack class that survives the defenses that stop distributional attacks. Where previous point-shift attacks create sparse outliers that outlier-removal and saliency-removal preprocessing can delete, the three proposed attacks—resampling a stretched alpha-shape surface, attaching line-segment sticks anchored to the object, and pulling points toward movable sink locations—produce continuous, connected deformations with no removable outliers. On ModelNet40 with 1,024-point clouds, against PointNet, PointNet++, and DGCNN, all three shape attacks hold success rates that in most cases stay above roughly 65% under outlier and salient point removal, while the distributional attacks often fall below 55% under the same defenses. The authors conclude that point-removal defenses are relatively ineffective against shape attacks, and that robust 3D perception needs new defenses.","pith_inferences":["Because adversarial sinks requires no surface reconstruction, it should transfer to raw LiDAR-style scans where alpha-shape triangulation is unreliable; the paper does not test this.","If deformation-based attacks survive point-removal preprocessing, defenses should shift toward checking local shape consistency, such as curvature or geodesic structure, rather than point statistics.","The reported reliance on alpha-shape reconstruction suggests that thin or open objects are the natural test bed for bounding when shape attacks degenerate into noisy perturbations.","The fully differentiable sink mechanism could likely be adapted to point-cloud segmentation and object detection, not just classification."],"forward_implications":["Point-removal defenses are not sufficient on their own for 3D classifiers; a deployed pipeline needs defenses against continuous deformation.","Because shape attacks create outlier-free deformations, statistical filters based on nearest-neighbor distances will not detect them.","Stronger point-removal defenses remain ineffective: as more points are removed, shape attacks keep high success while distributional attacks collapse within the tested range.","Adversarial sinks is fully differentiable and is reported as the most successful attack, suggesting it is the most practical threat among the three.","The authors argue the larger, focused deformations can be physically realized through 3D printing or bending, making shape attacks relevant beyond digital settings."],"supporting_citations":[{"why":"Introduces the outlier-removal and salient-point-removal defenses plus the gradient-projection attack this paper generalizes; its claim that these defenses stop small perturbations is the baseline the shape attacks challenge.","marker":"[16]"},{"why":"Proposes outlier-guided point removal, the defense class the paper evaluates against.","marker":"[36]"},{"why":"Provides the Chamfer-distance attack and the added-cluster attack that adversarial sticks improves on, and gives the preceding adversarial point-cloud baseline.","marker":"[32]"},{"why":"Supplies the alpha-shape algorithm used to reconstruct surfaces from point clouds.","marker":"[9]"},{"why":"Provides the 3D Delaunay triangulation that the alpha-shape reconstruction is built on.","marker":"[15]"},{"why":"Defines PointNet, the primary attacked architecture; its max-pooling over critical points is used to explain why sink-based deformations succeed.","marker":"[23]"},{"why":"Supplies PointNet++, one of the three classification architectures used to measure attack success.","marker":"[24]"},{"why":"Supplies DGCNN, the third architecture used for evaluation.","marker":"[28]"},{"why":"Provides the ModelNet40 dataset used for training and testing all attacks and defenses.","marker":"[31]"},{"why":"Supplies the VP-tree nearest-neighbor structure used for fast point-to-triangle projection in the gradient-projection and sticks attacks.","marker":"[34]"}],"fun_headline_variants":["Shape attacks outlast point-removal defenses","Deformations dodge 3D point defenses","3D point clouds: shape attacks beat filters","Continuous warps bypass point-removal filters"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the surface-estimation step (alpha-shape triangulation) faithfully recovers the object's continuous surface from the point cloud, so the resampled points stay on that surface rather than becoming removable outliers; the paper itself notes that triangulation on a fixed number of points leaves missing-point artifacts.","fun_headline_variants_meta":{"raw":{"variants":["Shape attacks outlast point-removal defenses","Deformations dodge 3D point defenses","3D point clouds: shape attacks beat filters","Continuous warps bypass point-removal filters"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000134,"raw_usage":{"total_tokens":1088,"prompt_tokens":846,"completion_tokens":242,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":462,"completion_tokens_details":{"reasoning_tokens":183}},"tokens_in":462,"tokens_out":242,"duration_ms":2769,"temperature":1.0,"reasoning_tokens":183,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:56:19.694083+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run perturbation resampling and adversarial sticks on thin or open shapes—like a hollow tube or a flat sheet sampled with 1,024 points—and apply outlier removal; if alpha-shape reconstruction fails, the resampled points will scatter off the true surface and the attack success rate should fall to the level of ordinary point-shift attacks.","supporting_citations":[{"cited_title":"Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifiers","cited_arxiv_id":"1901.03006","evidence_quote":"Introduces the outlier-removal and salient-point-removal defenses plus the gradient-projection attack this paper generalizes; its claim that these defenses stop small perturbations is the baseline the shape attacks challenge."},{"cited_title":"IEEE Transactions on Information Theory 29(4), 551–559 (1983)","cited_arxiv_id":null,"evidence_quote":"Supplies the alpha-shape algorithm used to reconstruct surfaces from point clouds."},{"cited_title":"International Journal of Computer & Information Sciences 9(3), 219–242 (1980)","cited_arxiv_id":null,"evidence_quote":"Provides the 3D Delaunay triangulation that the alpha-shape reconstruction is built on."},{"cited_title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition 1(2), 4 (2017)","cited_arxiv_id":null,"evidence_quote":"Defines PointNet, the primary attacked architecture; its max-pooling over critical points is used to explain why sink-based deformations succeed."},{"cited_title":"In: Advances in Neural Information Processing Systems","cited_arxiv_id":null,"evidence_quote":"Supplies PointNet++, one of the three classification architectures used to measure attack success."},{"cited_title":"ACM Transactions on Graphics (TOG) (2019)","cited_arxiv_id":null,"evidence_quote":"Supplies DGCNN, the third architecture used for evaluation."},{"cited_title":"In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","cited_arxiv_id":null,"evidence_quote":"Provides the ModelNet40 dataset used for training and testing all attacks and defenses."},{"cited_title":"In: Proceedings of the fourth annual ACM-SIAM symposium on Discrete algorithms","cited_arxiv_id":null,"evidence_quote":"Supplies the VP-tree nearest-neighbor structure used for fast point-to-triangle projection in the gradient-projection and sticks attacks."}],"review_version":1}