REVIEW 3 major objections 5 minor 36 references
Adversarial shape perturbations on 3D point clouds
T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash
Pith's one-line read By deforming the surface of a 3D point cloud instead of nudging isolated points, three new attacks keep high success rates even after outlier-removal and salient-point-removal defenses, making point-removal preprocessing insufficient…
desk verdict Shape-deforming attacks, especially adversarial sinks, genuinely beat point-removal defenses in this paper; the alpha-shape reliance in two of the three attacks is a real but fixable gap, and the core finding deserves peer review. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing objects are three deformation mechanisms plus one surface estimate. The paper estimates the underlying surface $\mathcal{S}$ (or the adversarial surface $\mathcal{S}^*$) of a point cloud using $\alpha$-shape reconstruction from a 3D Delaunay triangulation; this triangulated surface is what connects perturbed points into a continuous shape. Perturbation resampling maximizes a minimum pairwise-distance objective and uses farthest-point sampling to redistribute resampled points on the deformed surface. Adversarial sticks optimize vectors for a few perturbed anchor points, projects them back onto the benign surface, and resamples points along the resulting line-segment features. Adversarial sinks deform the entire cloud by shifting every point toward movable sink points through a Gaussian radial basis function, with no surface reconstruction at all.
What would settle it
Run perturbation resampling and adversarial sticks on thin or open shapes—like a hollow tube or a flat sheet sampled with 1,024 points—and apply outlier removal; if alpha-shape reconstruction fails, the resampled points will scatter off the true surface and the attack success rate should fall to the level of ordinary point-shift attacks.
Extended reading notes
Core claim
The paper's central claim is that shape-level perturbations form a distinct attack class that survives the defenses that stop distributional attacks. Where previous point-shift attacks create sparse outliers that outlier-removal and saliency-removal preprocessing can delete, the three proposed attacks—resampling a stretched alpha-shape surface, attaching line-segment sticks anchored to the object, and pulling points toward movable sink locations—produce continuous, connected deformations with no removable outliers. On ModelNet40 with 1,024-point clouds, against PointNet, PointNet++, and DGCNN, all three shape attacks hold success rates that in most cases stay above roughly 65% under outlier and salient point removal, while the distributional attacks often fall below 55% under the same defenses. The authors conclude that point-removal defenses are relatively ineffective against shape attacks, and that robust 3D perception needs new defenses.
Load-bearing premise
The load-bearing premise is that the surface-estimation step (alpha-shape triangulation) faithfully recovers the object's continuous surface from the point cloud, so the resampled points stay on that surface rather than becoming removable outliers; the paper itself notes that triangulation on a fixed number of points leaves missing-point artifacts.
Editorial extensions
If this is right
- Point-removal defenses are not sufficient on their own for 3D classifiers; a deployed pipeline needs defenses against continuous deformation.
- Because shape attacks create outlier-free deformations, statistical filters based on nearest-neighbor distances will not detect them.
- Stronger point-removal defenses remain ineffective: as more points are removed, shape attacks keep high success while distributional attacks collapse within the tested range.
- Adversarial sinks is fully differentiable and is reported as the most successful attack, suggesting it is the most practical threat among the three.
- The authors argue the larger, focused deformations can be physically realized through 3D printing or bending, making shape attacks relevant beyond digital settings.
Reading between the lines
- Because adversarial sinks requires no surface reconstruction, it should transfer to raw LiDAR-style scans where alpha-shape triangulation is unreliable; the paper does not test this.
- If deformation-based attacks survive point-removal preprocessing, defenses should shift toward checking local shape consistency, such as curvature or geodesic structure, rather than point statistics.
- The reported reliance on alpha-shape reconstruction suggests that thin or open objects are the natural test bed for bounding when shape attacks degenerate into noisy perturbations.
- The fully differentiable sink mechanism could likely be adapted to point-cloud segmentation and object detection, not just classification.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper studies adversarial attacks on 3D point cloud classifiers and distinguishes two attack families: distributional attacks, which add small imperceptible perturbations to all points, and shape attacks, which deform the object surface in a focused and more perceptible way. The authors propose three shape attacks: perturbation resampling, which resamples low-saliency points onto an alpha-shape estimated surface; adversarial sticks, which creates protruding line-segment features on the surface; and adversarial sinks, which smoothly deforms the point cloud through learnable sink points. Experiments on ModelNet40 with PointNet, PointNet++, and DGCNN evaluate the attacks under random point removal, outlier removal, and salient point removal defenses. The main empirical claim, driven primarily by Table 2 and Figure 3, is that the shape attacks—especially adversarial sinks—maintain high success rates against these point-removal defenses, whereas distributional attacks degrade substantially. Source code is available.
Significance. If the results hold, the paper makes a useful contribution by identifying a class of shape-deforming adversarial perturbations that can bypass point-removal defenses, which were previously shown to be effective against small distributional attacks. The open-source implementation, evaluation across three architectures and three defenses, and the introduction of a fully differentiable, surface-free attack (adversarial sinks) are notable strengths. The paper also usefully articulates a perceptibility-robustness trade-off for 3D point cloud attacks. However, the strength of the conclusions is tempered by the lack of quantitative validation of the alpha-shape reconstruction used by two of the three attacks, by the absence of distortion metrics when comparing attacks with very different perceptibility budgets, and by evaluation-methodology concerns such as possible test-set tuning and missing error bars.
major comments (3)
- [Section 6.1 and 6.2, Figure 2 caption] The perturbation resampling and adversarial sticks attacks depend on an alpha-shape triangulation to reconstruct the surface S* or S from a finite point cloud, but the paper provides no quantitative validation of this reconstruction. The Figure 2 caption itself concedes that "some areas are noticeably missing points in the perturbation resampling adversarial examples, which is due to limitations in the triangulation procedure on a fixed number of points." If the reconstructed surface is inaccurate, the resampled points may not lie on a clean continuous surface, and the claimed mechanism for defense robustness—that the attacks produce continuous, outlier-free deformations—is not established for these two attacks. Please add surface-fidelity metrics (e.g., distance between resampled points and the original mesh, or an ablation using the ground-truth mesh instead of the alpha-shape estimate) or otherwise demonstrate that the attacks' success does not stem from triangulation artifacts.
- [Section 7.1 and Table 2] The success rates of the shape attacks and the distributional baselines are compared without reporting the actual perceptibility of the generated adversarial examples. Shape attacks are described as intentionally larger and more localized than distributional attacks, so their higher robustness under point removal is expected from their larger perturbation budget; the paper even admits in Section 7.1 that "directly comparing the attacks that use binary search with those that do not is unfair," yet Table 2 is presented as a head-to-head comparison. Please report per-attack distortion metrics (Chamfer distance, Hausdorff distance, and L2 norm relative to the benign cloud) and provide a success-versus-distortion analysis so that the robustness claim is not attributable solely to a larger perceptibility budget.
- [Section 7.1] The hyperparameters for all attacks were "determined through rudimentary grid search," and the test split of ModelNet40 is used for evaluation, with no indication that a separate validation set was used for tuning. This creates a risk that the reported success rates are optimistically biased through test-set overfitting. Please clarify whether hyperparameters were tuned on the test set; if so, re-tune on a validation split and report test results. Additionally, Table 2 and Figure 3 report single point estimates without confidence intervals, and for several configurations the differences between attacks are small (e.g., PointNet with outlier removal: perturbation resampling 81.6%, sticks 86.8%, sinks 84.7%), so error bars or confidence intervals should be provided to support the comparative claims.
minor comments (5)
- [Section 6.3] The opening sentence, "Due to resampling and projection operations used in the adversarial sinks attack that make optimization difficult," appears to describe the adversarial sticks or perturbation resampling attacks rather than adversarial sinks; please reword to avoid confusion.
- [Equation (2)] The set-builder expression has an unmatched parenthesis and uses the symbol 'epsilon' both for the defense threshold and for the attack perturbation bound; please introduce a different symbol for the defense threshold.
- [Table 2] The success rate is not explicitly defined; please state that it is the fraction of correctly classified benign examples that the attack misclassifies, and report the number of examples used per architecture.
- [Section 7.1] The sentence "we will show the effect of changing some of them in our experiments" is vague; Figure 4 and Table 3 only cover a subset of attacks and defenses, so please state which hyperparameters are varied and which are held fixed.
- [Section 2.1] Reference [16] is cited both as an attack and as the source of the defenses evaluated later; the related-work discussion would be clearer if this dual role were stated explicitly.
Circularity Check
No load-bearing circularity: attack success rates are independently measured; self-citations are contextual and not used to force the central claim.
full rationale
The paper's central claim is that the proposed shape attacks remain effective against point-removal defenses. This is an empirical result, measured on PointNet, PointNet++, and DGCNN with fixed defense hyperparameters, and is not obtained by fitting a parameter and then re-predicting that same fitted quantity. The defenses from the authors' prior work [16] are used as fixed evaluation benchmarks; the attacks are not optimized to evade those defenses, so the comparison is not circular. The self-citations to [16] for gradient projection, outlier removal, salient point removal, and the critical-point intuition are contextual and provide background rather than load-bearing derivation. The alpha-shape surface reconstruction used in perturbation resampling and adversarial sticks is a potential correctness or robustness risk, because inaccurate triangulation could make the attacks behave like noisy perturbations, but this is a question of empirical validity, not definitional circularity: the paper does not define, for example, attack success in terms of the alpha-shape output. Similarly, the outlier-free property of the shape attacks makes them robust against outlier removal by construction, but this is a design property, not a case of the paper deriving a prediction from its own fitted input. No equation or result in the paper reduces to an input of the same derivation, and no externally falsifiable benchmark is replaced by an author-imported uniqueness claim.
Assumptions & free parameters
free parameters (4)
- Perturbation resampling hyperparameters (epsilon, kappa, n) =
epsilon=2, kappa=500, n=100
- Adversarial sticks hyperparameters (sigma, mu, alpha, lambda, eta, n) =
sigma=100, mu=2, alpha=0.01, lambda binary searched, eta=0.1, n=20
- Adversarial sinks hyperparameters (sigma, mu, alpha, beta, lambda, eta, n) =
sigma=30, mu=7, alpha=5, beta=1, lambda binary searched, eta=0.1, n=20
- Baseline attack parameters (epsilon, tau, alpha, lambda, eta) =
Iter. L2: epsilon=2; Chamfer: alpha=0.002, lambda binary searched; Grad. proj.: epsilon=1, tau=0.05
assumptions (4)
- domain assumption White-box threat model with full access to the classifier.
- domain assumption Alpha shape triangulation reliably reconstructs the object surface from a point cloud.
- domain assumption PointNet's max pooling creates critical points whose gradients dominate classification.
- domain assumption Outlier removal and salient point removal from the authors' prior paper [16] represent realistic defenses.
Cite this review
Pith. "Pith review of Adversarial shape perturbations on 3D point clouds." pith.science (2026). https://pith.science/paper/5CZPQZ7U
@misc{pith2026190806062,
author = {Pith},
title = {Pith review of: Adversarial shape perturbations on 3D point clouds},
year = {2026},
howpublished = {\url{https://pith.science/paper/5CZPQZ7U}},
note = {Machine review of arXiv:1908.06062}
}
read the original abstract
The importance of training robust neural network grows as 3D data is increasingly utilized in deep learning for vision tasks in robotics, drone control, and autonomous driving. One commonly used 3D data type is 3D point clouds, which describe shape information. We examine the problem of creating robust models from the perspective of the attacker, which is necessary in understanding how 3D neural networks can be exploited. We explore two categories of attacks: distributional attacks that involve imperceptible perturbations to the distribution of points, and shape attacks that involve deforming the shape represented by a point cloud. We explore three possible shape attacks for attacking 3D point cloud classification and show that some of them are able to be effective even against preprocessing steps, like the previously proposed point-removal defenses.
Figures
Figures from the paper (1 more)
Reference graph
Works this paper leans on
-
[26]
In: Proceedings of the AAAI Conference on Artificial Intelligence
Tsai, T., Yang, K., Ho, T.Y., Jin, Y.: Robust adversarial objects against deep learning models. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 34, pp. 954–962 (2020)
work page 2020
-
[16]
Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifiers
Liu, D., Yu, R., Su, H.: Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifiers. arXiv preprint arXiv:1901.03006 (2019)
work page Pith review arXiv 2019
-
[36]
arXiv preprint arXiv:1812.11017 (2018)
Zhou, H., Chen, K., Zhang, W., Fang, H., Zhou, W., Yu, N.: Deflecting 3D Adversar- ial Point Clouds Through Outlier-Guided Removal. arXiv preprint arXiv:1812.11017 (2018)
arXiv 2018
-
[1]
IEEE Transactions on Visualization and Computer Graphics 5(4), 349–359 (1999)
Bernardini, F., Mittleman, J., Rushmeier, H., Silva, C., Taubin, G.: The ball- pivoting algorithm for surface reconstruction. IEEE Transactions on Visualization and Computer Graphics 5(4), 349–359 (1999)
work page 1999
-
[2]
In: Joint European Conference on Machine Learning and Knowledge Discovery in Databases
Biggio, B., Corona, I., Maiorca, D., Nelson, B., ˇSrndi´ c, N., Laskov, P., Giacinto, G., Roli, F.: Evasion Attacks Against Machine Learning at Test Time. In: Joint European Conference on Machine Learning and Knowledge Discovery in Databases. pp. 387–402. Springer (2013)
work page 2013
-
[3]
Pattern Recognition 84, 317–331 (2018)
Biggio, B., Roli, F.: Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning. Pattern Recognition 84, 317–331 (2018)
work page 2018
-
[4]
arXiv preprint arXiv:1712.09665 (2017)
Brown, T.B., Man´ e, D., Roy, A., Abadi, M., Gilmer, J.: Adversarial Patch. arXiv preprint arXiv:1712.09665 (2017)
arXiv 2017
-
[5]
arXiv preprint arXiv:1907.05418 (2019)
Cao, Y., Xiao, C., Yang, D., Fang, J., Yang, R., Liu, M., Li, B.: Adversar- ial Objects Against LiDAR-Based Autonomous Driving Systems. arXiv preprint arXiv:1907.05418 (2019)
arXiv 2019
Show all 36 references
-
[6]
In: 2017 IEEE Symposium on Security and Privacy
Carlini, N., Wagner, D.: Towards Evaluating the Robustness of Neural Networks. In: 2017 IEEE Symposium on Security and Privacy. pp. 39–57. IEEE (2017)
2017
-
[7]
arXiv preprint arXiv:1808.10322 (2018)
Deng, H., Birdal, T., Ilic, S.: PPF-FoldNet: Unsupervised Learning of Rotation Invariant 3D Local Descriptors. arXiv preprint arXiv:1808.10322 (2018)
2018 arXiv
-
[8]
arXiv preprint (2018)
Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., Li, J.: Boosting Adversarial Attacks with Momentum. arXiv preprint (2018)
2018
-
[9]
IEEE Transactions on Information Theory 29(4), 551–559 (1983)
Edelsbrunner, H., Kirkpatrick, D., Seidel, R.: On the shape of a set of points in the plane. IEEE Transactions on Information Theory 29(4), 551–559 (1983)
1983
-
[10]
arXiv preprint arXiv:1412.6572 (2014)
Goodfellow, I., Shlens, J., Szegedy, C.: Explaining and Harnessing Adversarial Examples. arXiv preprint arXiv:1412.6572 (2014)
2014 arXiv
-
[11]
arXiv preprint arXiv:1809.08758 (2018)
Guo, C., Frank, J.S., Weinberger, K.Q.: Low frequency adversarial perturbation. arXiv preprint arXiv:1809.08758 (2018)
2018 arXiv
-
[12]
arXiv preprint arXiv:1412.6980 (2014)
Kingma, D.P., Ba, J.: Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)
2014 arXiv
-
[13]
arXiv preprint arXiv:1607.02533 (2016)
Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial Examples in the Physical World. arXiv preprint arXiv:1607.02533 (2016)
2016 arXiv
-
[14]
arXiv preprint arXiv:1611.01236 (2016) Adversarial Shape Perturbations on 3D Point Clouds 17
Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial Machine Learning at Scale. arXiv preprint arXiv:1611.01236 (2016) Adversarial Shape Perturbations on 3D Point Clouds 17
2016 arXiv
-
[15]
International Journal of Computer & Information Sciences 9(3), 219–242 (1980)
Lee, D.T., Schachter, B.J.: Two algorithms for constructing a Delaunay triangulation. International Journal of Computer & Information Sciences 9(3), 219–242 (1980)
1980
-
[17]
arXiv preprint arXiv:1706.06083 (2017)
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards Deep Learning Models Resistant to Adversarial Attacks. arXiv preprint arXiv:1706.06083 (2017)
2017 arXiv
-
[18]
In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition
Moosavi-Dezfooli, S.M., Fawzi, A., Fawzi, O., Frossard, P.: Universal adversarial perturbations. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 1765–1773 (2017)
2017
-
[19]
In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition
Moosavi-Dezfooli, S.M., Fawzi, A., Frossard, P.: DeepFool: A simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 2574–2582 (2016)
2016
-
[20]
In: 2016 IEEE European Symposium on Security and Privacy (EuroS&P)
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.: The Limitations of Deep Learning in Adversarial Settings. In: 2016 IEEE European Symposium on Security and Privacy (EuroS&P). pp. 372–387. IEEE (2016)
2016
-
[21]
In: 2016 IEEE Sym- posium on Security and Privacy (SP)
Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A.: Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks. In: 2016 IEEE Sym- posium on Security and Privacy (SP). pp. 582–597. IEEE (2016)
2016
-
[22]
arXiv preprint arXiv:1711.08488 (2017)
Qi, C.R., Liu, W., Wu, C., Su, H., Guibas, L.J.: Frustum PointNets for 3D Object Detection from RGB-D Data. arXiv preprint arXiv:1711.08488 (2017)
2017 arXiv
-
[23]
Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition 1(2), 4 (2017)
Qi, C.R., Su, H., Mo, K., Guibas, L.J.: PointNet: Deep Learning on Point Sets for 3D Classification and Segmentation. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition 1(2), 4 (2017)
2017
-
[24]
In: Advances in Neural Information Processing Systems
Qi, C.R., Yi, L., Su, H., Guibas, L.J.: PointNet++: Deep Hierarchical Feature Learning on Point Sets in a Metric Space. In: Advances in Neural Information Processing Systems. pp. 5099–5108 (2017)
2017
-
[25]
arXiv preprint arXiv:1312.6199 (2013)
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fergus, R.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)
2013 arXiv
-
[27]
ACM Transactions on Graphics 36(4), 72 (2017)
Wang, P.S., Liu, Y., Guo, Y.X., Sun, C.Y., Tong, X.: O-CNN: Octree-based con- volutional neural networks for 3D shape analysis. ACM Transactions on Graphics 36(4), 72 (2017)
2017
-
[28]
ACM Transactions on Graphics (TOG) (2019)
Wang, Y., Sun, Y., Liu, Z., Sarma, S.E., Bronstein, M.M., Solomon, J.M.: Dynamic graph CNN for learning on point clouds. ACM Transactions on Graphics (TOG) (2019)
2019
-
[29]
In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition
Wicker, M., Kwiatkowska, M.: Robustness of 3D Deep Learning in an Adversarial Setting. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 11767–11775 (2019)
2019
-
[30]
arXiv preprint arXiv:1711.00851 (2017)
Wong, E., Kolter, J.Z.: Provable Defenses against Adversarial Examples via the Convex Outer Adversarial Polytope. arXiv preprint arXiv:1711.00851 (2017)
2017 arXiv
-
[31]
In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition
Wu, Z., Song, S., Khosla, A., Yu, F., Zhang, L., Tang, X., Xiao, J.: 3D ShapeNets: A Deep Representation for Volumetric Shapes. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 1912–1920 (2015)
2015
-
[32]
arXiv preprint arXiv:1809.07016 (2018)
Xiang, C., Qi, C.R., Li, B.: Generating 3D Adversarial Point Clouds. arXiv preprint arXiv:1809.07016 (2018)
2018 arXiv
-
[33]
arXiv preprint arXiv:1902.10899 (2019) 18 Daniel Liu, Ronald Yu, and Hao Su
Yang, J., Zhang, Q., Fang, R., Ni, B., Liu, J., Tian, Q.: Adversarial Attack and Defense on Point Sets. arXiv preprint arXiv:1902.10899 (2019) 18 Daniel Liu, Ronald Yu, and Hao Su
2019 arXiv
-
[34]
In: Proceedings of the fourth annual ACM-SIAM symposium on Discrete algorithms
Yianilos, P.N.: Data Structures and Algorithms for Nearest Neighbor Search in General Metric Spaces. In: Proceedings of the fourth annual ACM-SIAM symposium on Discrete algorithms. vol. 93, pp. 311–21 (1993)
1993
-
[35]
arXiv preprint arXiv:1812.01687 (2018)
Zheng, T., Chen, C., Ren, K., et al.: Learning Saliency Maps for Adversarial Point- Cloud Generation. arXiv preprint arXiv:1812.01687 (2018)
2018 arXiv
Reviewed August 14, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.