{"id":"2a1c1a33-5746-4eef-88a3-2ebaa0c7ce40","arxiv_id":"2507.18870","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"MAT-Adv generates adversarial point clouds by perturbing learned medial axis transform representations, improving transferability and undefendability over the tested baselines.","lead":"This paper presents a new way to attack 3D point cloud classifiers: instead of moving individual points, it changes the shape's internal skeleton (medial axis transform) and then rebuilds the point cloud from the changed skeleton. The authors report that the attack works against models it was not trained on and survives common defenses.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed l∞ budget is not enforced for MAT-Adv, so its reported transferability and undefendability gains may stem from larger effective perturbations than the baselines are allowed.","rationale":"The reader's weakest assumption is exactly the one I would flag: the paper never constrains the actual point-space perturbation. The MAT encoder/decoder are learned nonlinear maps; Eq. (10) includes an MLP refinement, so l∞ control in the MAT latent space (via D_L) does not translate to l∞ control in the output. The stated ε values appear only as hyperparameter labels, and no projection step is described. This matters because the paper's contribution is comparative: MAT-Adv is claimed to beat 3D-Adv, AdvPC, AOF, PF-Attack, and KNN in transferability and undefendability under the same budgets. If its effective distortion exceeds the budget, higher ASRs are expected and the comparison is not apples-to-apples. This concern is easily settled by the concrete test above, so I do not move the verdict to rejection; the conditional verdict stands. The missing Mani-Adv baseline and the suspicious duplicated rows in Table 4 are additional weaknesses that also need the authors' attention, but they are secondary: even with Mani-Adv included and Table 4 corrected, the budget question must be resolved before any reported superiority can be accepted. I note the paper releases no code, so this check cannot currently be performed by readers; that is why the issue remains load-bearing rather than being dismissed as a writing omission.","tokens_in":17867,"tokens_out":6822,"duration_ms":73713,"concrete_test":"Using the reported training setup, generate MAT-Adv adversarial clouds for ShapeNet Part under ε=0.18 and ε=0.45. For each cloud, compute the maximum point-wise displacement from the original under the optimal matching (if point correspondence is unavailable, use the asymmetric Hausdorff distance max_{p'∈P_adv} min_{p∈P} ||p'-p|| as a conservative upper bound) and report the fraction exceeding ε. Then re-run the transfer experiments (Tables 1 and 4) after projecting/clipping every decoded adversarial cloud onto the l∞ ball of radius ε around the original cloud. If the MAT-Adv ASRs fall to the baseline level, the reported advantage is a budget artifact; if they remain high, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The decisive weak point is the unenforced l∞ budget. In Eq. (11) the objective is L_mis(f_s, D^{-1}(Θ+Δ), y) + λ1·D(P, D^{-1}(Θ+Δ)) + λ2·D_L(Δ), with D(P,·) the Chamfer distance and D_L the Frobenius norm. Section 5.1 pairs ε=0.18 with (λ1=10, λ2=0.1) and ε=0.45 with (λ1=1, λ2=0.01), but no clipping, projection, or post-decoding check of the reconstructed point coordinates is described. The decoder first samples points on perturbed medial spheres and then refines positions with an MLP (Eqs. 9-10), so even small MAT perturbations can be amplified into point displacements larger than ε. Chamfer distance is an average nearest-neighbor loss, not an upper bound on maximum displacement. Consequently the tables headed 'under l∞-norm perturbation budgets' may not describe MAT-Adv at all; its effective perturbation can be larger than what the baselines are allowed. Since ASR is monotone in distortion, the headline transferability and undefendability advantage could be an artifact of an unequal comparison. This is the most load-bearing issue because it affects every quantitative result, not just a single table.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes MAT-Adv, an adversarial attack on 3D point cloud classifiers. Instead of perturbing point coordinates directly, the method trains an autoencoder to map point clouds to a medial axis transform (MAT) representation (centers, radii, and per-sphere features), perturbs that representation through a differentiable optimization (Eq. 11), and decodes the result into an adversarial point cloud. A dropout strategy on the MAT perturbation is introduced to reduce overfitting to the surrogate model. Experiments on ShapeNet Part, ModelNet10, and ScanObjectNN report attack success rates for white-box, transfer, and defended scenarios under l_infinity budgets of 0.18 and 0.45, and claim consistent improvements over 3D-Adv, AdvPC, AOF, PF-Attack, and KNN.","tokens_in":18075,"tokens_out":6258,"duration_ms":58253,"significance":"If the reported numbers are correct, the paper would establish a new and conceptually interesting attack surface: perturbing a compact, interpretable geometric representation rather than raw coordinates, with gains in transferability and undefendability. The paper includes fairly extensive experiments across multiple datasets, classifiers, and defenses, and its ablations on the dropout strategy and on perturbing the MAT components are useful. However, the current manuscript does not demonstrate that the attacks are actually constrained by the claimed l_infinity budgets, and it omits the most closely related baseline (Mani-Adv). These issues put the empirical claims in doubt; the significance is therefore conditional on a corrected evaluation.","major_comments":[{"comment":"The paper reports results under l_infinity-norm perturbation budgets of ε=0.18 and ε=0.45, but the optimization in Eq. (11) contains no l_infinity constraint, projection, or clipping. The loss terms are the misclassification loss, the Chamfer distance, and the Frobenius norm on Δ; the decoder in Eqs. (9)–(10) is a learned MLP that can amplify small MAT changes into point displacements larger than ε. Because the Chamfer distance is an average nearest-neighbor loss, it does not bound the maximum displacement. The values in Tables 1–5 may therefore be produced with effective perturbations larger than what the baselines are allowed, and the reported gains could be an artifact of an unequal comparison. The authors should either enforce the l_infinity budget (e.g., project the decoded cloud or clip per-point displacements at each iteration) or compare all methods under a common distortion metric while reporting both the budget and the achieved distortion.","section":"Sec. 5.1 / Eq. (11)"},{"comment":"Mani-Adv [10] is the most closely related prior method: it also attacks through an intrinsic representation (a 2D parameter plane) and is explicitly motivated by transferability and undefendability. The manuscript cites and discusses Mani-Adv but never includes it as a baseline in Tables 1–5. Without this comparison, the claim that MAT-Adv significantly outperforms existing state-of-the-art methods is not supported. The authors should add Mani-Adv to the experimental comparison or justify its exclusion.","section":"Sec. 5.1, Baselines"},{"comment":"For ShapeNet Part, the DGCNN and PointConv blocks of Table 4 are identical in the no-defense, SRS, SOR, DUP-Net, and IF-Defense columns for every baseline, including 3D-Adv (100.00, 2.92, 1.77, 4.59, 0.70), AdvPC (98.89, 62.33, 49.04, 40.38, 10.47), and AOF (100.00, 53.25, 48.28, 41.32, 13.04); only the adversarial-training column differs. This suggests a copy-paste error or that the PointConv rows were not measured separately. Either way, the undefendability claims for PointConv are not supported by the reported data.","section":"Table 4"}],"minor_comments":[{"comment":"Table 1 contains a stray sentence in the table body after the ModelNet10 PointConv row, reading 'IF-Defense[50],whichcombinesoutlierfilteringwithshapeoptimization; and Adversarial Training [3]...' This appears to be a copy-paste error and should be moved to the caption or removed.","section":"Table 1"},{"comment":"Table 5 uses 'SOS' in the table body where 'SOR' (statistical outlier removal) is intended, and the second column header contains a typo 'Atttack'.","section":"Table 5"},{"comment":"Table 1 has a typo 'PonitNet++' in the ModelNet10 section.","section":"Table 1"},{"comment":"Equation (2) defines an objective with the composed classifier f_t⊕Defend, but this formulation is not used in the method or experiments; consider stating explicitly how defenses are integrated into the evaluation.","section":"Eq. (2)"},{"comment":"The term 'inherent adversarialness' is used throughout but never formally defined; consider replacing it with a more operational term or providing a concrete definition.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The l_infinity budget enforcement problem is the main blocking point; it was also independently flagged in a stress test of the manuscript. If the authors can show a post-hoc computation of the actual l_infinity distortion of their adversarial examples and the results remain favorable after enforcing the budget, the paper could become acceptable. The omission of Mani-Adv as a baseline is unusual given the paper's framing and should be addressed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this paper is worth reading but its central quantitative claim is not yet supported. MAT-Adv perturbs the medial axis transform (centers, radii, and associated features) learned by a Point2Skeleton-style autoencoder, with a dropout regularizer on the perturbation mask. That is a genuine new application of MAT to adversarial point clouds, and the idea is coherent. The dropout ablation shows a clear effect, the re-sampling sanity check in Table 7 is a nice external validation of the autoencoder's fidelity, and the writing is clear about the method's rationale.\n\nThe soft spots are structural, not cosmetic. Most importantly, the paper claims to operate under l∞ budgets of ε=0.18 and 0.45, but the optimization in Eq. (11) uses Chamfer distance plus a Frobenius regularization on Δ. No clipping, projection, or post-decoding check of actual point displacements is described. Since the decoder samples points on medial spheres and then refines positions with an MLP, small MAT perturbations can amplify into point moves larger than ε. Chamfer is an average, not a bound. So every table comparing MAT-Adv to baselines that do enforce l∞ may be comparing unequal perturbation sizes. ASR is monotone in distortion, so this alone could explain the reported gains. This is the load-bearing issue.\n\nSecond, Mani-Adv is cited as the closest prior work in the same program—perturbing an intrinsic representation for transferability and undefendability—but it is never evaluated as a baseline. That omission needs explaining. Third, Table 4 has PointConv rows that are near-identical to the DGCNN rows for the baseline methods, which looks like a copy-paste error and undermines confidence in the reported undefendability results. Code is also withheld, which matters for an empirical attack paper.\n\nIf the authors can enforce the budget (or honestly report effective distortion), add Mani-Adv, fix the table, and release code, the contribution could stand. As is, the empirical claims are unverified. I would send this to a serious referee because the idea and the framework are worth scrutiny, but I would not accept it in the current form.","headline":"A plausible new entry in the \"attack via intrinsic representation\" line, but the claimed l∞ budget is not actually enforced, so the headline transferability and undefendability numbers may just reflect larger perturbations.","tokens_in":18670,"tokens_out":1760,"would_cite":false,"duration_ms":20095,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Perturbing a point cloud's medial axis transform—its skeletal representation of maximal inscribed spheres—rather than its points, makes adversarial examples far more transferable to unseen classifiers and resistant to common defenses.","keywords":["Adversarial attacks","Point clouds","Deep neural networks","Medial axis transform","Transferability","Undefendability","Point cloud defense","3D classification"],"falsifier":"Take MAT-Adv's output clouds, compute the true maximal per-point perturbation $\\max_i \\|p_i^{\\mathrm{adv}} - p_i\\|_\\infty$ against the original input, and count how often it exceeds the claimed $\\epsilon$ of 0.18 or 0.45; then clip every perturbed point back into the $\\epsilon$-ball and re-measure transfer attack success. If a substantial share of examples exceed the budget and clipping collapses the transfer advantage to baseline levels, the central claim—that skeleton-space perturbation itself, not a larger effective budget, drives the gains—is refuted. A complementary check exploits the authors' stated limitation: run the attack on shapes with thin structures or complex topology, where they note MAT extraction is less stable, and see whether transferability drops on exactly those shapes.","tokens_in":17615,"feed_emoji":"🎯","tokens_out":20315,"duration_ms":185161,"temperature":0.7,"pith_summary":"The paper argues that the right surface to attack in a 3D point cloud is not the point coordinates but the shape's intrinsic skeleton: the medial axis transform (MAT), the set of maximal inscribed spheres whose centers and radii encode the object's structure. It proposes MAT-Adv, an autoencoder-based attack that maps a point cloud into a compact MAT representation, perturbs that representation during optimization, and decodes the result back into an adversarial point cloud, with a dropout strategy that randomly masks half the medial spheres each step to stop the perturbation collapsing onto a few of them. The payoff, demonstrated across three datasets and eight classifier architectures, is what the paper calls \"inherent adversarialness\": skeleton-level perturbations survive decoding into new surfaces, so they keep fooling classifiers the attacker never saw and keep working after denoising and outlier-removal defenses strip point-level noise. If the claim holds, the practical threat model for 3D perception—black-box, defended deployment in autonomous driving and robotics—is more exposed than point-level attack results suggested.","feed_headline":"Perturb the shape's skeleton, not the points, and fool unseen 3D models","feed_subtitle":"The same attacks keep over 40% success under IF-Defense, where most baselines fall to around 10%.","key_machinery":"The load-bearing object is the learned medial axis transform: an autoencoder whose encoder $E_\\Phi$ takes a sampled point cloud (via a PointNet++ backbone) and predicts the representation $\\Theta = \\langle \\mathcal{C}, \\mathcal{R}, \\mathcal{Z} \\rangle$—the centers and radii of the medial spheres plus auxiliary features—through convex-combination weights computed from point features, in the style of the Point2Skeleton encoder; the decoder $D_{\\Phi^{-1}}$ reconstructs a point cloud by uniformly sampling eight points on each medial sphere, interpolating sphere features by inverse-distance weights, and refining positions with an MLP. The MAT is the attack surface: the perturbation $\\Delta$ is added to $\\Theta$, not to the point coordinates, so the decoded cloud inherits structural-level changes that the paper argues are intrinsic to the shape and therefore persist across models and defenses. The second mechanism is a dropout strategy that, at each optimization iteration, randomly keeps perturbations on only half the medial spheres (dropout proportion $\\rho = 0.5$), which forces the adversarial signal to spread across the representation instead of overfitting the surrogate classifier.","core_discovery":"The paper's central claim is that perturbing the medial axis transform (MAT) representation of a point cloud, rather than the point coordinates themselves, yields adversarial examples that are simultaneously transferable and undefendable. Concretely, MAT-Adv optimizes $\\min_\\Delta L_{\\mathrm{mis}}(f_s, D_{\\Phi^{-1}}(\\Theta+\\Delta), y) + \\lambda_1 D_{\\mathrm{CD}}(\\mathcal{P}, D_{\\Phi^{-1}}(\\Theta+\\Delta)) + \\lambda_2 \\|\\Delta\\|_F$, where $\\Theta = \\langle \\mathcal{C}, \\mathcal{R}, \\mathcal{Z} \\rangle$ is the autoencoder's predicted set of medial sphere centers, radii, and auxiliary features, and the attack output is the decoded cloud $D_{\\Phi^{-1}}(\\Theta+\\Delta)$. On ShapeNet Part, ModelNet10, and the real-scanned ScanObjectNN, with $\\ell^\\infty$ budgets of $\\epsilon = 0.18$ and $0.45$, MAT-Adv reports the highest attack success rates in most black-box transfer configurations across PointNet, PointNet++, DGCNN, and PointConv, and against modern targets including CurveNet, PCT, Point Transformer, and Mamba3D. Against five defenses—random sampling, statistical outlier removal, DUP-Net, IF-Defense, and adversarial training—it retains substantially higher success than the baselines in most settings (for example, over 40% under IF-Defense where most baselines fall to roughly 10%). The dropout strategy is part of the mechanism, not a detail: removing it cuts transfer success from 40.83% to 20.88% in one PointNet-to-PointConv configuration.","pith_inferences":["The same recipe should transfer to other intrinsic shape representations—signed-distance fields, neural occupancy functions, or other skeletons—which would turn MAT-Adv into a template for representation-space attacks; whether the gains persist for representations without the sphere-sampling decoder is a testable question.","A defense implication the authors do not spell out: because the perturbation lives in medial-sphere space, defenses that only filter or denoise points will systematically miss it; effective countermeasures would need to estimate the medial structure of the input and detect or regularize deviations in sphere centers and radii.","The fixed dropout rate $\\rho = 0.5$ is chosen empirically, but the mechanism suggests an annealing or saliency-based schedule—masking only structurally important spheres, or varying $\\rho$ during optimization—could push transferability further; this is a direct extension of the paper's own ablation.","The paper's argument that perturbing \"intrinsic\" structure creates inherent adversarialness could be sharpened by a control experiment: perturb a randomly initialized latent representation of the same dimension with the same decoder and check whether transferability and undefendability drop; if they do not, the geometric content of the MAT, not the representation-space attack recipe, is doing the "],"forward_implications":["A surrogate-only attacker now has a plausible field recipe: adversarial clouds generated on one accessible model (DGCNN) mislead architecturally distinct targets such as CurveNet, PCT, Point Transformer, and Mamba3D at rates well above the strongest baselines, so the victim's weights are not needed.","Denoising-style defenses are no longer a reliable countermeasure at the tested budgets: under random sampling, statistical outlier removal, DUP-Net, and IF-Defense, MAT-Adv keeps markedly higher success than point- and frequency-domain baselines in most settings, with white-box success staying above 60% under SRS and DUP-Net on ShapeNet Part.","The ablation results pin the mechanism to the whole representation: perturbing only the sphere centers, only the radii, or only the attached features forfeits most of the transfer gain, so the full $\\langle \\mathcal{C}, \\mathcal{R}, \\mathcal{Z} \\rangle$ triple must move together.","The dropout component earns its keep: removing the random masking of perturbations drops transfer success from 40.83% to 20.88% in one PointNet-to-PointConv configuration, so the reported results depend on that regularizer, not only on the MAT representation.","On real scanned data (ScanObjectNN) every method's success rises because classifiers are weaker on noisy, incomplete input, yet MAT-Adv still leads most transfer configurations, so the advantage is not confined to clean synthetic shapes."],"supporting_citations":[{"why":"Defines the medial axis transform as the union of maximal inscribed spheres; the geometric object whose perturbation is the whole idea.","marker":"[11]"},{"why":"Supplies the skeleton-extraction encoder (convex-combination weights from point features) that MAT-Adv follows to obtain medial centers, radii, and features.","marker":"[38]"},{"why":"FoldingNet supplies the decoder architecture, which samples points per medial sphere and refines reconstructed positions.","marker":"[41]"},{"why":"AdvPC is the denoising-autoencoder attack that defines the inherent-adversarialness goal and is the closest baseline for undefendability.","marker":"[9]"},{"why":"Mani-Adv is the manifold-space attack showing that intrinsic perturbations transfer; the predecessor MAT-Adv extends from point geometry to the explicit medial axis.","marker":"[10]"},{"why":"Supplies the dropout principle that MAT-Adv adapts as random masking of perturbations on medial spheres.","marker":"[40]"},{"why":"DUP-Net combines outlier removal with upsampling; used as the key test of whether adversarial structure survives denoising defenses.","marker":"[49]"},{"why":"IF-Defense is the implicit-function-based restoration defense, the strongest denoising test, where MAT-Adv claims over 40% success against single-digit baselines.","marker":"[50]"},{"why":"3D-Adv sets the evaluation protocol (1,024-point sampling and $\\ell^\\infty$ budgets) and is the primary white-box baseline.","marker":"[2]"},{"why":"PointNet++ is the backbone of the MAT encoder and one of the four victim classifiers in the transfer evaluations.","marker":"[26]"}],"fun_headline_variants":["Perturb shape skeleton, not points, to fool 3D models","Skeleton-based attacks transfer across models, defeat defenses","MAT-Adv: attacks on medial axis, undefendable and transferable","Attacking medial axis boosts transfer, defeats 3D defenses","Skeleton-level perturbations keep adversarial 3D attacks effective"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Everything rests on the decoded adversarial cloud actually staying inside the declared perturbation budget: the attack loss in Eq. (11) penalizes Chamfer distance to the original cloud, and no point-wise projection or clipping onto the $\\ell^\\infty$ ball is described, so if the true maximal per-point displacement exceeds the claimed $\\epsilon$, the comparison against baselines that are constrained to that budget is not apples to apples.","fun_headline_variants_meta":{"raw":{"variants":["Perturb shape skeleton, not points, to fool 3D models","Skeleton-based attacks transfer across models, defeat defenses","MAT-Adv: attacks on medial axis, undefendable and transferable","Attacking medial axis boosts transfer, defeats 3D defenses","Skeleton-level perturbations keep adversarial 3D attacks effective"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000237,"raw_usage":{"total_tokens":1585,"prompt_tokens":1104,"completion_tokens":481,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":720,"completion_tokens_details":{"reasoning_tokens":391}},"tokens_in":720,"tokens_out":481,"duration_ms":5755,"temperature":1.0,"reasoning_tokens":391,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T18:06:30.810178+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take MAT-Adv's output clouds, compute the true maximal per-point perturbation $\\max_i \\|p_i^{\\mathrm{adv}} - p_i\\|_\\infty$ against the original input, and count how often it exceeds the claimed $\\epsilon$ of 0.18 or 0.45; then clip every perturbed point back into the $\\epsilon$-ball and re-measure transfer attack success. If a substantial share of examples exceed the budget and clipping collapses the transfer advantage to baseline levels, the central claim—that skeleton-space perturbation itself, not a larger effective budget, drives the gains—is refuted. A complementary check exploits the authors' stated limitation: run the attack on shapes with thin structures or complex topology, where they note MAT extraction is less stable, and see whether transferability drops on exactly those shapes.","supporting_citations":[{"cited_title":"Amenta, S","cited_arxiv_id":null,"evidence_quote":"Defines the medial axis transform as the union of maximal inscribed spheres; the geometric object whose perturbation is the whole idea."},{"cited_title":"4277–4286","cited_arxiv_id":null,"evidence_quote":"Supplies the skeleton-extraction encoder (convex-combination weights from point features) that MAT-Adv follows to obtain medial centers, radii, and features."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FoldingNet supplies the decoder architecture, which samples points per medial sphere and refines reconstructed positions."},{"cited_title":"Hamdi, S","cited_arxiv_id":null,"evidence_quote":"AdvPC is the denoising-autoencoder attack that defines the inherent-adversarialness goal and is the closest baseline for undefendability."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Mani-Adv is the manifold-space attack showing that intrinsic perturbations transfer; the predecessor MAT-Adv extends from point geometry to the explicit medial axis."},{"cited_title":"Srivastava, G","cited_arxiv_id":null,"evidence_quote":"Supplies the dropout principle that MAT-Adv adapts as random masking of perturbations on medial spheres."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"DUP-Net combines outlier removal with upsampling; used as the key test of whether adversarial structure survives denoising defenses."},{"cited_title":"Xiang, C","cited_arxiv_id":null,"evidence_quote":"3D-Adv sets the evaluation protocol (1,024-point sampling and $\\ell^\\infty$ budgets) and is the primary white-box baseline."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"PointNet++ is the backbone of the MAT encoder and one of the four victim classifiers in the transfer evaluations."}],"review_version":2}