{"id":"424679b9-f842-434e-a3a5-bfb4ad4a41a5","arxiv_id":"2506.06906","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"KNN-Defense applies nearest-neighbor search in feature space to 3D point cloud classification, improving robustness to adversarial perturbations without retraining.","lead":"KNN-Defense classifies 3D point clouds by voting among their closest matches in a training set, using feature representations from a pretrained classifier. It is a lightweight, retraining-free alternative to existing 3D adversarial defenses, and the authors report improved robustness on ModelNet40, especially against point-dropping attacks.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Adaptive attacks are missing: all evaluated attacks target the undefended classifier, so KNN-Defense's core kNN voting has never been attacked directly; a white-box adversary could steer the feature vector toward wrong-class training neighbors and bypass the defense.","rationale":"The paper's central empirical claim is conditional on a threat model in which attacks are generated against the plain classifier and then passed through KNN-Defense. Most prior 3D defenses (SRS, SOR, DUP-Net, IF-Defense) are compared under the same non-adaptive protocol, so the comparison is internally consistent and the reported gains are plausible. The method is simple, architecture-agnostic, and comes with code; that is genuine value. However, for a defense paper the decisive question is whether the defense survives an adversary that knows it. KNN-Defense's decision rule is a transparent function of feature-space distances to the training set, so it is particularly exposed: an attacker can directly optimize for proximity to wrong-class training features. The absence of any adaptive attack is a gap in the evidence, not a flaw in the derivation. The reader's weakest assumption—that adversarial perturbations leave the k nearest training neighbors voting correctly—is related but not identical; an adaptive attack would falsify that assumption by construction rather than by accident. I therefore agree with the conditional verdict: the non-adaptive results are likely valid, but the broad robustness claim should not be accepted until an adaptive evaluation is performed. I set verdict_should_be to UNCHANGED because the reader's conditional verdict already requires additional validation; my concern specifies one concrete missing validation.","tokens_in":12055,"tokens_out":5175,"duration_ms":56521,"concrete_test":"Implement a white-box adaptive attack against KNN-Defense: for each test point and target class t, select a training point Q in class t, and run PGD/C&W to minimize L_CE(F(P'), t) + lambda * ||L(P') - L(Q)||_2^2 with the same point-shifting/adding/dropping budgets as Tables 1-4. Because kNN selection is non-differentiable, use a soft-kNN relaxation (e.g., weighted average of all training softmax vectors with inverse-distance weights) for gradient computation, or use zeroth-order gradients. Then measure KNN-Defense accuracy on the generated adversarial clouds. If accuracy drops to near the undefended adversarial accuracy (or target success rises sharply), the reported robustness does not hold under an adaptive adversary; if accuracy remains high, the adaptive concern is resolved. Also report the same adaptive attack on the ScanObjectNN setting in Table 5.","verdict_should_be":"UNCHANGED","load_bearing_attack":"KNN-Defense classifies an input by averaging the softmax outputs of its k nearest training-set neighbors in the victim model's feature space (Algorithm 1, lines 4-6). The robustness numbers in Tables 1-5 are obtained from attacks (Shift-L2, Add-Chamfer, Add-Hausdorff, Drop, AdvPC, AOF) that were designed against the undefended classifier; none of them optimizes the input to influence the kNN vote. In a white-box setting, which the paper itself uses to generate attacks, the adversary also knows the feature extractor L and the training set. A targeted adaptive attack can then choose a training point Q of the desired class t and minimize L_CE(F(P'), t) + lambda * d(L(P'), L(Q)) subject to the same perturbation budget as the reported attacks. Because L and F are differentiable and d is smooth, this is a standard C&W/PGD-style optimization. If the optimizer finds point clouds that lie near class-t training features while remaining within budget, the k nearest neighbors will vote for class t and KNN-Defense will output the target class. The paper reports no such adaptive evaluation, so the central claim that KNN-Defense 'significantly improves robustness' is established only against attacks that ignore the defense. This is the most load-bearing gap: the method's only mechanism—feature-space neighbor voting—is exactly the component a knowledgeable adversary would target.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes KNN-Defense, a training-free defense for 3D point cloud classifiers. For each input, the method extracts a feature vector from a pretrained network's aggregation layer, finds its k nearest neighbors among training-set feature vectors, computes the softmax outputs of those neighbors, and assigns the class by a weighted average of those softmax vectors. Three weighting schemes (uniform, entropy-based, diversity-based) are proposed. The method is evaluated on ModelNet40 and ScanObjectNN against point-shifting, point-adding, point-dropping, AdvPC, and AOF attacks, and is compared with SRS, SOR, DUP-Net, and IF-Defense across PointNet, PointNet++, DGCNN, and PCT. The main reported gains are under point-dropping attacks, where the method outperforms IF-Defense by several percentage points on all four architectures, while being computationally lightweight.","tokens_in":12347,"tokens_out":5948,"duration_ms":72677,"significance":"If the robustness gains are confirmed under a properly adaptive threat model, KNN-Defense would be a useful, architecture-agnostic, retraining-free defense component with a simple and fast inference procedure. The paper's strengths include an open-source implementation, evaluation across four architectures and several attack families, and a clear algorithmic description that makes the method easy to reproduce. However, the current evidence is limited to attacks that target the undefended classifier, and the defense's own decision mechanism—the feature-space nearest-neighbor vote—is never adversarially optimized. Since the method is essentially a non-parametric classifier built on a pretrained feature extractor, its security claim requires an adaptive evaluation. The claimed state-of-the-art status is also stronger than the tables support, because on PointNet++ and DGCNN the proposed method lags behind IF-Defense on most targeted attacks.","major_comments":[{"comment":"All reported attacks are generated against the undefended classification network, not against KNN-Defense. The defense's final decision is a weighted average of softmax outputs of k nearest training-set neighbors in feature space. A white-box adversary who knows the feature extractor and the training set can run a PGD/C&W-style optimization to bring the adversarial feature vector close to training samples of a target class, directly manipulating which neighbors are retrieved and how they vote. No such adaptive attack is reported, so the paper's central claim that KNN-Defense 'significantly improves robustness' is established only against adversaries that ignore the defense. The authors should add an adaptive evaluation, for example by optimizing the input to minimize the cross-entropy of the final weighted-average softmax (with a differentiable relaxation of the kNN selection) under the same perturbation budgets used in the paper, and report the resulting accuracies.","section":"Section 4.2, Tables 1–5"},{"comment":"The hyperparameter k is selected using the same test set on which the final results in Tables 1–5 are reported, with no validation split or cross-validation. The statement 'As shown in Fig. 3, and based on the EW metric, the values selected were k=5 for PointNet, k=10 for PCT, and k=15 for PointNet++ and DGCNN' indicates that the test-set adversarial accuracy was used for model selection. This risks overfitting the defense to the specific test attack set and makes the comparison with baselines, whose hyperparameters are not tuned in the same way, potentially unfair. The authors should either use a separate validation split for selecting k or report sensitivity of the results to k across a range with error bars.","section":"Section 4.1, Fig. 3"},{"comment":"The text claims state-of-the-art results against 'most targeted attacks' on PointNet and PCT, but the tables show that on PointNet++ and DGCNN the proposed method is often substantially worse than IF-Defense. For example, Table 2 reports Pert accuracy of 63.69 for Ours(EW) versus 89.16 for IF-Defense on PointNet++; Table 3 reports 73.47 for Ours(EW) versus 90.00 for IF-Defense on DGCNN. The average gains come from point-dropping attacks, not from a consistent improvement across all attack types. The central claim should be qualified to the attack types and architectures where the improvement actually holds, or the paper should report an aggregate metric (e.g., mean accuracy over attack types) with statistical significance tests.","section":"Section 4.2, Tables 1–5"},{"comment":"The paper repeatedly describes the method as 'projecting adversarial inputs back onto the manifold' and 'restoring perturbed inputs,' but Algorithm 1 never reconstructs a point cloud; it only replaces the classifier's decision by a weighted kNN vote over training softmax vectors. This is not merely a wording issue: the defense's validity depends on the premise that the feature-space neighborhood of an attacked input contains mostly same-class training samples. The paper does not directly measure neighbor label purity or how often the kNN set changes under attack. Adding such an analysis (e.g., reporting the fraction of correct-class neighbors and the confidence of the vote) would substantiate the manifold assumption and help explain the empirical behavior.","section":"Section 3.1 and Algorithm 1"}],"minor_comments":[{"comment":"Line 3 writes d_i(P) = D(P, P'_i), but the distance is computed between feature vectors after applying L; it should be D(L(P), L(P'_i)) or the notation for D should be defined on feature space.","section":"Algorithm 1, lines 3–4"},{"comment":"There is a typo in Section 2.1: 'an important res ce in many applications' should read 'an important resource in many applications.'","section":"Introduction, Section 2.1"},{"comment":"The abstract and conclusion state that the method 'restores perturbed inputs,' which overstates what the algorithm does. The method outputs a class label, not a restored point cloud; this should be reworded consistently.","section":"Abstract and Section 5"},{"comment":"The ScanObjectNN results show that KNN-Defense is not consistently competitive with IF-Defense on targeted attacks (e.g., Pert: 46.67 for Ours(EW) versus 53.26 for IF-Defense). The discussion acknowledges this in passing, but the abstract and introduction should not claim general state-of-the-art robustness without mentioning this caveat.","section":"Table 5"},{"comment":"The runtime comparison would be more informative if it also reported the memory/storage overhead of the feature database and the time for feature extraction, since the method requires storing and searching the full training-set feature bank.","section":"Section 4.2.1"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is within scope for a computer vision venue. The core idea is simple and reproducible, but the absence of adaptive attacks is a serious gap for a defense paper, and the test-set-based selection of k inflates confidence in the numbers. I would not reject if the authors can add an adaptive evaluation and a validation-based hyperparameter selection, because the non-adaptive results are credible and the method is lightweight. I would also suggest the authors tone down the state-of-the-art claim until the point-dropping versus targeted-attack discrepancy is addressed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Bottom line: the paper does what it says, and the method is simple enough to be useful. It takes Dubey et al.'s web-scale nearest-neighbor defense, adapts it to 3D point clouds by working in the classifier's feature space, and evaluates it on four architectures against several attack families. The reported numbers are mostly better than IF-Defense and the other baselines, especially on dropping attacks, and the open-source code is a plus. That is a legitimate new empirical result, even if the conceptual novelty is limited.\n\nThe main thing to flag is the threat model. All of the attacks in the paper were generated against the undefended classifier. None of them knows that the final prediction is a weighted vote over k training-set neighbors in feature space. In a white-box setting, which the paper itself assumes, an adversary can optimize the point cloud so its feature vector lands near wrong-class training samples; the kNN vote would then be corrupted directly. That is not a hypothetical failure mode; it is a standard C&W/PGD-style objective with an extra distance term to a target class prototype. Without that adaptive evaluation, the claim that KNN-Defense significantly improves robustness is only established for attacks that ignore the defense. This is the load-bearing gap.\n\nThere are smaller issues. The value of k is chosen from experiments on the test adversarial examples (Fig. 3, Section 4.1); there is no validation split, so the reported numbers likely overfit the hyperparameter. Tables report a single run, so no error bars or significance tests. Clean accuracy drops by 2–5 points on most models, which is not catastrophic but should be discussed. On ScanObjectNN the method is competitive but not state of the art; the authors acknowledge the difficulty, which is fair.\n\nThat said, the method is clearly described, reproducible, and the experiments are broad enough to be informative. The weakness is not the algorithm itself; it is the evaluation protocol. I would send this to peer review, but I would ask the authors to run at least one adaptive attack, to move k selection to a validation split, and to report variance. If they can show the defense holds up under an attack that targets the kNN vote, the paper becomes a solid contribution. If not, the honest conclusion is that the defense helps against off-the-shelf attacks but is not a strong security guarantee.","headline":"A clean, honest transfer of the 2D kNN defense to 3D point clouds that reports real gains against non-adaptive attacks, but the central robustness claim is not tested against an adversary that actually targets the kNN vote.","tokens_in":12882,"tokens_out":3244,"would_cite":true,"duration_ms":35823,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"KNN-Defense defends 3D point cloud classifiers by replacing the classifier's decision with a weighted vote among the k nearest training-set samples in feature space, improving accuracy against point-dropping, point-shifting, and…","keywords":["3D point clouds","adversarial defense","adversarial attack","manifold assumption","nearest-neighbor search","feature space","ModelNet40"],"falsifier":"Construct adversarial point clouds that optimize the attack objective to minimize feature-space distance to a wrong-class training centroid while staying within the perturbation budgets used in the paper; if such clouds flip the nearest-neighbor vote to the wrong class, then the manifold-projection assumption is violated and the defense collapses.","tokens_in":11869,"feed_emoji":"🛡️","tokens_out":12976,"duration_ms":108752,"temperature":0.7,"pith_summary":"This paper proposes KNN-Defense, a preprocessing defense for 3D point cloud classifiers that requires no retraining or architectural changes. Under the manifold assumption that clean point clouds form a low-dimensional structure while adversarial examples are displaced from it, the method projects each input back toward the manifold by finding the $k$ nearest training samples in the feature space of a pretrained network and aggregating their softmax outputs with one of three weighting functions. On ModelNet40, this restores accuracy under point-shifting, point-adding, and point-dropping attacks across PointNet, PointNet++, DGCNN, and PCT, with the largest gains on dropping attacks where many prior defenses fail. The method is lightweight, running in about 5.4 ms per cloud with uniform weighting, and generalizes across attack types without being tailored to a specific threat model.","feed_headline":"Nearest-neighbor voting beats 3D point-dropping attacks","feed_subtitle":"Projecting adversarial clouds onto training-set manifold in feature space gains up to 20% accuracy over prior defenses.","key_machinery":"The machinery is the feature-space nearest-neighbor projection: for an input cloud $P$, extract the global feature vector $L(P)$ from a chosen layer of the pretrained classifier, compute distances $D(P, P')$ to all training clouds in that space, select the $k$ closest, and take the class that maximizes the weighted average of the neighbors' softmax vectors. One of three weighting functions assigns the weights: uniform weighting, entropy-based weighting (which up-weights confident softmax vectors), or diversity-based weighting (which up-weights vectors with a large gap between the top and next $M$ entries). This substitutes the empirical distribution of training features for the unknown data manifold, so the defense never needs to reconstruct the original surface.","core_discovery":"The central claim is that adversarial perturbations displace a point cloud's feature representation from the clean-data manifold, and that projecting the adversarial input back onto that manifold can be approximated by a weighted vote over the $k$ nearest training-set neighbors in feature space. The paper demonstrates that this feature-space nearest-neighbor voting, with uniform, entropy-based, or diversity-based weighting, improves classification accuracy under point-shifting, point-adding, and point-dropping attacks on four standard 3D classifiers. Against point-dropping of 200 points on ModelNet40, KNN-Defense exceeds IF-Defense by 20.1, 3.6, 3.44, and 7.74 percentage points on PointNet, PointNet++, DGCNN, and PCT, respectively. The defense works by computing the global feature vector of the input, retrieving the $k$ closest training features, and returning the class that maximizes the weighted average of the neighbors' softmax vectors, with no geometric reconstruction or retraining.","pith_inferences":["Per-class nearest-neighbor label purity should predict where the defense succeeds: classes with sparse or scattered training features will get less reliable votes, so measuring purity per class would localize expected accuracy drops.","If the feature-space displacement of adversarial examples is small, an attack that directly optimizes feature distance to a wrong-class centroid could break the defense; testing such an attack would probe whether the manifold assumption holds in practice.","The confidence-weighting idea is general and could transfer beyond nearest-neighbor search, e.g., combining any feature-space denoiser with entropy- or diversity-based weighting in other 3D recognition tasks."],"forward_implications":["On ModelNet40 point-dropping attacks that remove 200 points, KNN-Defense outperforms IF-Defense by 20.1, 3.6, 3.44, and 7.74 percentage points on PointNet, PointNet++, DGCNN, and PCT.","The defense requires no retraining or architecture changes, so any pretrained point cloud classifier that exposes a feature layer can be wrapped with KNN-Defense as a preprocessing front-end.","The method is fast enough for near-real-time use: about 5.4 ms per cloud with uniform weighting, roughly six times faster than IF-Defense.","On the real-world ScanObjectNN dataset, the defended PCT model stays competitive and gives its largest gains on untargeted point-dropping attacks."],"supporting_citations":[{"why":"Supplies the original image-domain nearest-neighbor defense that this method adapts to 3D point clouds.","marker":"[46]"},{"why":"Provides the targeted attack generation methods and the augmented ModelNet40 dataset used in the evaluation.","marker":"[26]"},{"why":"Defines the point-dropping attack used as the primary untargeted benchmark.","marker":"[27]"},{"why":"Is the principal baseline, IF-Defense, whose results the proposed method is compared against and exceeds on dropping attacks.","marker":"[36]"},{"why":"Is one of the four victim classifiers; its feature layer is used for the nearest-neighbor search.","marker":"[21]"},{"why":"Is the source of the ModelNet40 dataset used for training and evaluation.","marker":"[47]"}],"fun_headline_variants":["Vote of neighbors 3D-foils point-dropping attacks","Feature-space KNN wins 20% extra vs point drops","KNN projection: 20% tougher on point-cloud attacks","Nearest-neighbor vote disarms 3D adversarial drops"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense assumes that an adversarial perturbation moves a point cloud's feature representation away from the clean-data manifold but still into a region where the $k$ nearest training-set neighbors vote for the correct class, so the pretrained feature extractor must preserve semantic similarity under attack.","fun_headline_variants_meta":{"raw":{"variants":["Vote of neighbors 3D-foils point-dropping attacks","Feature-space KNN wins 20% extra vs point drops","KNN projection: 20% tougher on point-cloud attacks","Nearest-neighbor vote disarms 3D adversarial drops"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000317,"raw_usage":{"total_tokens":1840,"prompt_tokens":1042,"completion_tokens":798,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":658,"completion_tokens_details":{"reasoning_tokens":724}},"tokens_in":658,"tokens_out":798,"duration_ms":8970,"temperature":1.0,"reasoning_tokens":724,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T05:45:35.358222+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct adversarial point clouds that optimize the attack objective to minimize feature-space distance to a wrong-class training centroid while staying within the perturbation budgets used in the paper; if such clouds flip the nearest-neighbor vote to the wrong class, then the manifold-projection assumption is violated and the defense collapses.","supporting_citations":[{"cited_title":"In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp","cited_arxiv_id":null,"evidence_quote":"Supplies the original image-domain nearest-neighbor defense that this method adapts to 3D point clouds."},{"cited_title":"In: Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp","cited_arxiv_id":null,"evidence_quote":"Provides the targeted attack generation methods and the augmented ModelNet40 dataset used in the evaluation."},{"cited_title":"In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp","cited_arxiv_id":null,"evidence_quote":"Defines the point-dropping attack used as the primary untargeted benchmark."},{"cited_title":"In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp","cited_arxiv_id":null,"evidence_quote":"Is one of the four victim classifiers; its feature layer is used for the nearest-neighbor search."},{"cited_title":"In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp","cited_arxiv_id":null,"evidence_quote":"Is the source of the ModelNet40 dataset used for training and evaluation."}],"review_version":1}