{"id":"502e2612-137b-423a-9c98-207d1f8c6af1","arxiv_id":"2412.19015","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Adversarial point cloud attacks become more imperceptible when perturbation directions are adjusted with a learned point-to-surface field that drags points back to the underlying surface.","lead":"This paper proposes a point-to-surface field that guides adversarial perturbations on 3D point clouds back toward the object's surface, making attacks harder to notice. The authors show that their field-guided attack achieves lower distortion metrics than six prior methods across three classifiers and two datasets.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The P2S field's central mechanism—dragging points to the original object's surface—is never directly verified; per-instance field correctness remains untested.","rationale":"The reader's weakest assumption identifies the same load-bearing concern: the learned P2S field may not represent the per-instance surface of each test object. I reached the same point independently. This concern is load-bearing because every reported imperceptibility metric (CD, HD, l2, GR, Curv, EMD) compares the adversarial cloud to the original point cloud globally; any systematic smoothing or magnitude reduction would improve all of them without demonstrating that points were dragged onto the true surface. The paper provides no measurement of point-to-surface distance for the generated adversarial clouds, and Eq. (6) does not implement a projection, only a direction adjustment. The proposed concrete test would settle the question using existing meshes and the same evaluation protocol. This does not invalidate the paper; it strengthens the case for a conditional acceptance pending the surface-distance verification. I chose UNCHANGED because the reader's CONDITIONAL verdict already reflects this uncertainty, and my concern does not move the verdict further.","tokens_in":9079,"tokens_out":3544,"duration_ms":38696,"concrete_test":"On ModelNet40 and ShapeNet Part test objects with available ground-truth meshes, compute the per-point distance from each adversarial point cloud to the original object's surface for Ours, IFGM, and ITA at matched 100% ASR, and test whether Ours significantly reduces this distance relative to baselines. Additionally, train the P2S field in three variants—category-agnostic, per-category, and per-instance—and compare the attack metrics. If the category-agnostic field yields the same improvement, or if point-to-original-surface distance is not lower for Ours than for baselines, then the mechanism claimed in Eq. (3) is unsupported and the reported metric gains cannot be attributed to surface preservation.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that adversarial imperceptibility improves because the P2S field F(q)=∇ log Q_S(q) (Eq. 5, Section IV-A) drags perturbed points back to the surface S of the specific test object. This requires F at each adversarial point to point toward that object's surface, not merely toward a category-mean high-density region learned from training point clouds. The paper never verifies the defining inequality (3) for any generated adversarial cloud. In the actual update, Eq. (6) only adds a distance-weighted component of F to the perturbation direction, and the final point is moved by an attack step (7) whose magnitude is set by the attack procedure, not by any projection onto S. Consequently, the improvements in CD, HD, l2, GR, Curv, and EMD in Table I could arise from generic denoising or shrinkage of the perturbation rather than from true surface adherence. The ablation in Table II (forward vs. reverse field) shows the field matters, but not that it is the correct field for each instance. Since the field is trained following [36], which provides a category-level shape prior, per-instance surface preservation is exactly the assumption that must be tested before the headline claim is accepted.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a point-to-surface (P2S) field, defined as the gradient of the log-density of the shape surface, learned by a denoising network following [36], and uses it to adjust the perturbation directions of iterative adversarial attacks on 3D point clouds. The method is evaluated on ModelNet40 and ShapeNet Part against PointNet, DGCNN, and PointConv classifiers, comparing with six baselines. The experiments report 100% attack success rates in all configurations and show that P2S-guided attacks achieve lower Chamfer distance, Hausdorff distance, l2 norm, geometric regularity, curvature, and Earth mover's distance in most cases. The authors conclude that guiding perturbations along the P2S field makes adversarial point clouds more imperceptible by keeping points closer to the underlying surface.","tokens_in":9358,"tokens_out":6622,"duration_ms":61651,"significance":"If the central mechanism is verified, the paper would be a useful contribution by introducing a surface-aware directional guidance that is orthogonal to existing distance-constrained and normal/tangential attacks. The paper's strengths include a clear problem framing, the simple integration of the field into three existing attack methods, and the forward/reverse ablation that demonstrates the field's effect. However, the core claimed mechanism, per-instance surface adherence, is asserted rather than verified, and reproducibility is hampered by missing training details. The empirical gains are plausible but do not yet conclusively support the stated surface-preservation explanation; the improvements could also stem from generic smoothing or shrinkage of the perturbation.","major_comments":[{"comment":"The learned field F(q)=∇ log Q_S(q) is claimed to drag perturbed points back to the original surface S, but no evidence is provided that inequality (3) holds for adversarial points on each test instance. Since Q_S is described only as 'the true data distribution' learned 'following [36]', it is unclear whether F is conditioned on the individual point cloud or is a global or category-level shape prior; both are possible from the text. If F is a global prior, the improvements in Tables I-III could be caused by generic denoising rather than surface adherence. Please (i) specify the conditioning mechanism of the denoising network, and (ii) report per-instance statistics of D(q, S) vs. D(q+F(q), S) over generated adversarial clouds to substantiate the defining property of the P2S field.","section":"Section IV-A, Eqs. (3)-(5)"},{"comment":"The architecture and training procedure of the P2S field network are not described. In particular, the 'ground-truth gradients estimated from the input point cloud' and the loss function are not defined, and no training hyperparameters are given. Without these details the method cannot be reproduced. The fact that the field is trained on the same datasets (ModelNet40, ShapeNet Part) used for attack evaluation also raises a circularity concern that is not addressed. Please provide the network architecture, the denoising/score-matching objective, the noise schedule, and a statement of whether the exact object instances used in attack evaluation appear in the P2S field training set.","section":"Section IV-A and V-A"},{"comment":"The perturbation-direction update is not fully specified. Equation (6) appears to add θ||p'(t)_i - p_i|| · F(p') / ||F(p')|| to a unit direction, but the notation for the direction is garbled and the normalization after the update is not stated. The magnitude determination 'following [31]' is a reference to a heuristic that is not summarized, and the number of iterations and the stopping criterion are missing. Please provide a formal algorithm listing all steps, dimensions, normalization, iteration count, and the exact magnitude update rule.","section":"Section IV-B, Eqs. (6)-(7)"},{"comment":"The evaluation protocol 'configure each attack method to achieve its maximum attack success rate' is not operationalized. It is unclear how the baselines are tuned, whether all methods are given the same computational budget, and how 'maximum ASR' is defined when multiple configurations achieve 100%. This matters for the fairness of the metric comparison: if methods are stopped at different perturbation budgets, the distortion numbers are not directly comparable. Please specify the tuning procedure, the stopping rule, and the ranges of perturbation budgets examined for each method.","section":"Section V-B, Table I and Section V-A"}],"minor_comments":[{"comment":"In several configurations (e.g., PointNet/ShapeNet Part Curv: Ours 0.492 vs. SI-Adv 0.441; DGCNN/ShapeNet Part Curv: Ours 2.521 vs. GeoA3 1.695 and SI-Adv 2.054), the proposed method is not the best. The sentence 'surpasses these state-of-the-art methods across the majority of metrics' should be replaced with a precise count or a per-matrix summary of where the method wins and loses.","section":"Table I, Section V-B"},{"comment":"The arrow notation '- - - →' used in Eqs. (1), (6), and (7) is not defined and appears visually broken. Define the unit perturbation direction vector explicitly and use a standard notation such as bold d_i throughout.","section":"Section IV-B"},{"comment":"The weighting hyperparameter θ=0.5 is fixed without sensitivity analysis. A short ablation over θ (e.g., 0.1, 0.5, 1.0) would strengthen the claim that the method is robust to this choice.","section":"Section V-A"},{"comment":"The preliminary formulation in Eq. (2) sets up a joint optimization over σ and d, but the subsequent method does not directly use this objective; clarify the relationship between Eq. (2) and the IFGM-based iterative procedure.","section":"Section III, Eq. (2)"},{"comment":"The labels 'w/ -' and 'w/ +' are not explained in the caption; define 'reverse' and 'forward' explicitly so the reader can interpret the ablation without referring to the main text.","section":"Table II caption"},{"comment":"The claim of being 'the first to attribute the inadequate imperceptibility ... to deviation from the underlying surface' may conflict with the related work, including [33] and [26], which already discuss surface- and normal-aware perturbation directions; please either nuance the novelty claim or justify it with a specific comparison.","section":"Section I"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is from a group that cites several of its own prior works on imperceptible point cloud attacks (e.g., [25], [26], [28], [33]). The novelty claim 'first to attribute ... to deviation from the underlying surface' should be verified against these prior papers, in particular [33] and [26], which the manuscript itself lists as related work. If the idea already appears there, the contribution reduces to an incremental engineering variant. This does not affect my technical assessment above, but it may be relevant for the editor's judgment of scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know before you read it. First, the P2S field idea is real: training a gradient field of log density and using it to reorient attack directions is not in the prior work I know, and plugging it into PGD, IFGM, and SI-Adv gives consistent imperceptibility gains. Second, the paper's central story—that adversarial points are dragged back to the test object's original surface—is not actually verified. The field is a category-level shape prior learned from training data, and the authors never check that it points to the right surface for each specific instance.\n\nThe experiments are the strongest part. At 100% ASR across PointNet, DGCNN, and PointConv on ModelNet40 and ShapeNet Part, their CD, HD, l2, GR, Curv, and EMD are lower than six baselines in almost every row of Table I. The forward-vs-reverse field ablation (Table II) is a nice control, and the generalization table showing the field plugged into three existing attacks is the right way to demonstrate that the field carries the weight.\n\nThe soft spots are in proportion. Most important: the P2S field is trained following Cai et al. [36], which gives a distribution over shapes, not a per-instance surface. Inequality (3), the defining property of the field, is never evaluated on generated adversarial clouds. So the \"original underlying surface\" language overreaches; the improvements could come from generic denoising or perturbation shrinkage rather than true surface adherence. The stress-test note makes this exact point and I think it lands. Second, the paper omits the denoiser architecture, training details, and the perturbation magnitude schedule, and no code is released, so independent reproduction is hard. Third, the \"first to attribute\" claim in the intro is too strong—GeoA3, ITA, and their own FLAT already exploit geometry; what's new is the field itself, not the attribution.\n\nWho is this for? People working on 3D adversarial robustness, specifically imperceptibility. It deserves a serious referee: the idea is novel, the experiments are consistent, and the main weakness is verifiable with code release and per-shape evaluation. I would send it to review, asking the authors to release code and add a per-instance check that the field actually moves points closer to the true surface.","headline":"A genuinely novel surface-field mechanism for point cloud attacks with consistent empirical wins, but the per-instance surface claim is unverified and the paper is under-specified.","tokens_in":9881,"tokens_out":2824,"would_cite":true,"duration_ms":27998,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that point-cloud adversarial attacks become imperceptible when perturbed points are dragged back to the object's underlying surface, and it shows that a learned point-to-surface field does this while keeping 100% attack…","keywords":["adversarial attacks","point clouds","imperceptibility","point-to-surface field","surface preservation","3D classification","deep learning","gradient field"],"falsifier":"For a held-out set of shapes, compare the learned field $F(q)$ against the ground-truth direction from $q$ to the nearest point on the object's true surface; if the average cosine similarity is low or if projecting adversarial points along the field increases point-to-surface distance on some categories, the claim that the field preserves the underlying surface would be refuted.","tokens_in":8923,"feed_emoji":"🎯","tokens_out":6536,"duration_ms":198485,"temperature":0.7,"pith_summary":"This paper argues that the reason adversarial point-cloud attacks look wrong is not how far points move but whether they leave the object's underlying surface. To fix that, it learns a point-to-surface (P2S) field from noisy point clouds and uses it during an attack to drag each perturbed point back toward the surface. The authors show that with this guidance, attacks still fool PointNet, DGCNN, and PointConv at a 100% success rate while reducing Chamfer distance, Hausdorff distance, $\\ell_2$ norm, curvature, geometric regularity, and Earth mover's distance compared with six baselines. The central thesis is that surface fidelity, not displacement size, is the right knob for imperceptibility.","feed_headline":"Surface-guided attacks fool 3D classifiers with less distortion","feed_subtitle":"A learned point-to-surface field keeps 100% attack success on three models while cutting six distortion metrics.","key_machinery":"The load-bearing object is the point-to-surface (P2S) field, defined as the gradient of the log-density of the shape's surface distribution, $F(q) = \\nabla_q \\log Q_S(q)$. A denoising network is trained on noisy point clouds to predict this gradient field, so at any query point the field points toward the nearest high-density surface region. In the attack loop, Eq. (6) adjusts each adversarial perturbation direction by adding $\\theta \\|p'^{(t)}_i - p_i\\| \\cdot F(p'^{(t)}_i)/\\|F(p'^{(t)}_i)\\|$, making the correction grow with distance from the original point; Eq. (7) then sets the magnitude. The field is what converts an ordinary displacement-based attack into a surface-preserving one, and the ablations show that reversing the field degrades imperceptibility while forward guidance improves it.","core_discovery":"The paper's central claim is that imperceptibility in point-cloud attacks should be formulated as surface preservation: a perturbed point is perceptible when it deviates from the surface, so attacks should steer perturbations back onto that surface. It defines a point-to-surface field $F(q) = \\nabla_q \\log Q_S(q)$, where $Q_S$ approximates the data distribution concentrated on the shape surface, and trains a denoising network to predict this gradient field following [36]. During an attack, the field is sampled at each adversarial point, its direction is added with a distance-aware weight to the perturbation direction from IFGM, and then the perturbation magnitude is set following [31]. Iterating these steps yields adversarial clouds that are nearly outlier-free in visualizations and achieve 100% attack success while improving all six imperceptibility metrics over PGD, IFGM, GeoA3, 3d-Adv, SI-Adv, and ITA.","pith_inferences":["If the learned field is a category-level shape prior rather than a per-instance surface, attacks on objects outside the training distribution could drag points toward the wrong geometry; testing the field per shape, per category, and on unseen classes would tell whether the imperceptibility gains are surface preservation or dataset-specific regularization.","The same surface-fidelity principle could be repurposed for defense: a denoiser that projects adversarial points back onto the learned surface before classification might neutralize a large class of perturbation attacks, since the attack's effectiveness relies on surface deviation.","A direct test of the field's fidelity would be to compare $F(q)$ against the ground-truth nearest-surface direction for held-out instances; if the cosine similarity is low for some categories, the reported metric gains would need to be reinterpreted."],"forward_implications":["Under equal maximum attack success rates, the P2S-guided attack achieves lower Chamfer distance, Hausdorff distance, $\\ell_2$ norm, curvature, geometric regularity, and Earth mover's distance than PGD, IFGM, GeoA3, 3d-Adv, SI-Adv, and ITA on ModelNet40 and ShapeNet Part.","The field generalizes as a plug-in: adding P2S guidance to PGD, IFGM, and SI-Adv improves their imperceptibility metrics under identical parameter settings.","Because points remain near the surface, slightly larger displacements during an attack need not become more perceptible, breaking the usual trade-off between imperceptibility and attack effectiveness.","The reverse-direction ablation supports the causal story: moving adversarial points away from the surface makes the attack more perceptible, while moving them toward the surface makes it less perceptible."],"supporting_citations":[{"why":"Supplies the gradient-field training procedure used to learn the P2S field F(q) = grad log Q_S(q).","marker":"[36]"},{"why":"Provides the IFGM initial perturbation generator and the PGD baseline.","marker":"[37]"},{"why":"Provides the perturbation-magnitude determination step and the ITA baseline.","marker":"[31]"},{"why":"GeoA3 baseline that maintains local curvatures and is compared against.","marker":"[30]"},{"why":"SI-Adv baseline guiding perturbations along shape-invariant directions, compared against.","marker":"[32]"},{"why":"Introduces 3d-Adv and the classic l2/Chamfer/Hausdorff displacement constraints for point-cloud attacks.","marker":"[6]"},{"why":"PointNet victim classifier used in the attack evaluations.","marker":"[40]"},{"why":"DGCNN victim classifier used in the attack evaluations.","marker":"[41]"},{"why":"PointConv victim classifier used in the attack evaluations.","marker":"[42]"}],"fun_headline_variants":["Surface-guided attacks are imperceptible and still fool 3D models","Adversarial point clouds stay on-surface: imperceptible attacks","Point-to-surface field makes 3D attacks harder to spot","Surface-true perturbations: imperceptible 3D attacks","Imperceptible point-cloud attacks by steering back to surface"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes the learned point-to-surface field actually points toward the true surface of the specific object being attacked; if the field only encodes a generic prior, dragging points along it could move them toward the wrong geometry and the improved metrics would not reflect true surface preservation.","fun_headline_variants_meta":{"raw":{"variants":["Surface-guided attacks are imperceptible and still fool 3D models","Adversarial point clouds stay on-surface: imperceptible attacks","Point-to-surface field makes 3D attacks harder to spot","Surface-true perturbations: imperceptible 3D attacks","Imperceptible point-cloud attacks by steering back to surface"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000554,"raw_usage":{"total_tokens":2608,"prompt_tokens":879,"completion_tokens":1729,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":495,"completion_tokens_details":{"reasoning_tokens":1641}},"tokens_in":495,"tokens_out":1729,"duration_ms":14204,"temperature":1.0,"reasoning_tokens":1641,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T00:57:20.271058+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For a held-out set of shapes, compare the learned field $F(q)$ against the ground-truth direction from $q$ to the nearest point on the object's true surface; if the average cosine similarity is low or if projecting adversarial points along the field increases point-to-surface distance on some categories, the claim that the field preserves the underlying surface would be refuted.","supporting_citations":[{"cited_title":"Learning gradient fields for shape generation,","cited_arxiv_id":null,"evidence_quote":"Supplies the gradient-field training procedure used to learn the P2S field F(q) = grad log Q_S(q)."},{"cited_title":"Imperceptible transfer attack and defense on 3d point cloud classification,","cited_arxiv_id":null,"evidence_quote":"Provides the perturbation-magnitude determination step and the ITA baseline."},{"cited_title":"Dynamic graph cnn for learning on point clouds,","cited_arxiv_id":null,"evidence_quote":"DGCNN victim classifier used in the attack evaluations."}],"review_version":1}