Pith. sign in

REVIEW 4 major objections 6 minor 47 references

Imperceptible Adversarial Attacks on Point Clouds Guided by Point-to-Surface Field

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that point-cloud adversarial attacks become imperceptible when perturbed points are dragged back to the object's underlying surface, and it shows that a learned point-to-surface field does this while keeping 100% attack…

desk verdict A genuinely novel surface-field mechanism for point cloud attacks with consistent empirical wins, but the per-instance surface claim is unverified and the paper is under-specified. read the letter →

arxiv 2412.19015 v1 pith:5JB4TOFI submitted 2024-12-26 cs.CV cs.CR

Keke Tang , Weiyao Ke , Weilong Peng , Xiaofei Wang , Ziyong Du , Zhize Wu , Peican Zhu , Zhihong Tian This is my paper · ORCID
classification cs.CVcs.CR
keywords adversarialattackspointcloudsimperceptibilitypoint-to-surfacefieldsurfacepreservation3Dclassificationdeeplearninggradient
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the reason adversarial point-cloud attacks look wrong is not how far points move but whether they leave the object's underlying surface. To fix that, it learns a point-to-surface (P2S) field from noisy point clouds and uses it during an attack to drag each perturbed point back toward the surface. The authors show that with this guidance, attacks still fool PointNet, DGCNN, and PointConv at a 100% success rate while reducing Chamfer distance, Hausdorff distance, $\ell_2$ norm, curvature, geometric regularity, and Earth mover's distance compared with six baselines. The central thesis is that surface fidelity, not displacement size, is the right knob for imperceptibility.

What carries the argument

The load-bearing object is the point-to-surface (P2S) field, defined as the gradient of the log-density of the shape's surface distribution, $F(q) = \nabla_q \log Q_S(q)$. A denoising network is trained on noisy point clouds to predict this gradient field, so at any query point the field points toward the nearest high-density surface region. In the attack loop, Eq. (6) adjusts each adversarial perturbation direction by adding $\theta \|p'^{(t)}_i - p_i\| \cdot F(p'^{(t)}_i)/\|F(p'^{(t)}_i)\|$, making the correction grow with distance from the original point; Eq. (7) then sets the magnitude. The field is what converts an ordinary displacement-based attack into a surface-preserving one, and the ablations show that reversing the field degrades imperceptibility while forward guidance improves it.

What would settle it

For a held-out set of shapes, compare the learned field $F(q)$ against the ground-truth direction from $q$ to the nearest point on the object's true surface; if the average cosine similarity is low or if projecting adversarial points along the field increases point-to-surface distance on some categories, the claim that the field preserves the underlying surface would be refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that imperceptibility in point-cloud attacks should be formulated as surface preservation: a perturbed point is perceptible when it deviates from the surface, so attacks should steer perturbations back onto that surface. It defines a point-to-surface field $F(q) = \nabla_q \log Q_S(q)$, where $Q_S$ approximates the data distribution concentrated on the shape surface, and trains a denoising network to predict this gradient field following [36]. During an attack, the field is sampled at each adversarial point, its direction is added with a distance-aware weight to the perturbation direction from IFGM, and then the perturbation magnitude is set following [31]. Iterating these steps yields adversarial clouds that are nearly outlier-free in visualizations and achieve 100% attack success while improving all six imperceptibility metrics over PGD, IFGM, GeoA3, 3d-Adv, SI-Adv, and ITA.

Load-bearing premise

The attack assumes the learned point-to-surface field actually points toward the true surface of the specific object being attacked; if the field only encodes a generic prior, dragging points along it could move them toward the wrong geometry and the improved metrics would not reflect true surface preservation.

Editorial extensions

If this is right

  • Under equal maximum attack success rates, the P2S-guided attack achieves lower Chamfer distance, Hausdorff distance, $\ell_2$ norm, curvature, geometric regularity, and Earth mover's distance than PGD, IFGM, GeoA3, 3d-Adv, SI-Adv, and ITA on ModelNet40 and ShapeNet Part.
  • The field generalizes as a plug-in: adding P2S guidance to PGD, IFGM, and SI-Adv improves their imperceptibility metrics under identical parameter settings.
  • Because points remain near the surface, slightly larger displacements during an attack need not become more perceptible, breaking the usual trade-off between imperceptibility and attack effectiveness.
  • The reverse-direction ablation supports the causal story: moving adversarial points away from the surface makes the attack more perceptible, while moving them toward the surface makes it less perceptible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the learned field is a category-level shape prior rather than a per-instance surface, attacks on objects outside the training distribution could drag points toward the wrong geometry; testing the field per shape, per category, and on unseen classes would tell whether the imperceptibility gains are surface preservation or dataset-specific regularization.
  • The same surface-fidelity principle could be repurposed for defense: a denoiser that projects adversarial points back onto the learned surface before classification might neutralize a large class of perturbation attacks, since the attack's effectiveness relies on surface deviation.
  • A direct test of the field's fidelity would be to compare $F(q)$ against the ground-truth nearest-surface direction for held-out instances; if the cosine similarity is low for some categories, the reported metric gains would need to be reinterpreted.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a point-to-surface (P2S) field, defined as the gradient of the log-density of the shape surface, learned by a denoising network following [36], and uses it to adjust the perturbation directions of iterative adversarial attacks on 3D point clouds. The method is evaluated on ModelNet40 and ShapeNet Part against PointNet, DGCNN, and PointConv classifiers, comparing with six baselines. The experiments report 100% attack success rates in all configurations and show that P2S-guided attacks achieve lower Chamfer distance, Hausdorff distance, l2 norm, geometric regularity, curvature, and Earth mover's distance in most cases. The authors conclude that guiding perturbations along the P2S field makes adversarial point clouds more imperceptible by keeping points closer to the underlying surface.

Significance. If the central mechanism is verified, the paper would be a useful contribution by introducing a surface-aware directional guidance that is orthogonal to existing distance-constrained and normal/tangential attacks. The paper's strengths include a clear problem framing, the simple integration of the field into three existing attack methods, and the forward/reverse ablation that demonstrates the field's effect. However, the core claimed mechanism, per-instance surface adherence, is asserted rather than verified, and reproducibility is hampered by missing training details. The empirical gains are plausible but do not yet conclusively support the stated surface-preservation explanation; the improvements could also stem from generic smoothing or shrinkage of the perturbation.

major comments (4)
  1. [Section IV-A, Eqs. (3)-(5)] The learned field F(q)=∇ log Q_S(q) is claimed to drag perturbed points back to the original surface S, but no evidence is provided that inequality (3) holds for adversarial points on each test instance. Since Q_S is described only as 'the true data distribution' learned 'following [36]', it is unclear whether F is conditioned on the individual point cloud or is a global or category-level shape prior; both are possible from the text. If F is a global prior, the improvements in Tables I-III could be caused by generic denoising rather than surface adherence. Please (i) specify the conditioning mechanism of the denoising network, and (ii) report per-instance statistics of D(q, S) vs. D(q+F(q), S) over generated adversarial clouds to substantiate the defining property of the P2S field.
  2. [Section IV-A and V-A] The architecture and training procedure of the P2S field network are not described. In particular, the 'ground-truth gradients estimated from the input point cloud' and the loss function are not defined, and no training hyperparameters are given. Without these details the method cannot be reproduced. The fact that the field is trained on the same datasets (ModelNet40, ShapeNet Part) used for attack evaluation also raises a circularity concern that is not addressed. Please provide the network architecture, the denoising/score-matching objective, the noise schedule, and a statement of whether the exact object instances used in attack evaluation appear in the P2S field training set.
  3. [Section IV-B, Eqs. (6)-(7)] The perturbation-direction update is not fully specified. Equation (6) appears to add θ||p'(t)_i - p_i|| · F(p') / ||F(p')|| to a unit direction, but the notation for the direction is garbled and the normalization after the update is not stated. The magnitude determination 'following [31]' is a reference to a heuristic that is not summarized, and the number of iterations and the stopping criterion are missing. Please provide a formal algorithm listing all steps, dimensions, normalization, iteration count, and the exact magnitude update rule.
  4. [Section V-B, Table I and Section V-A] The evaluation protocol 'configure each attack method to achieve its maximum attack success rate' is not operationalized. It is unclear how the baselines are tuned, whether all methods are given the same computational budget, and how 'maximum ASR' is defined when multiple configurations achieve 100%. This matters for the fairness of the metric comparison: if methods are stopped at different perturbation budgets, the distortion numbers are not directly comparable. Please specify the tuning procedure, the stopping rule, and the ranges of perturbation budgets examined for each method.
minor comments (6)
  1. [Table I, Section V-B] In several configurations (e.g., PointNet/ShapeNet Part Curv: Ours 0.492 vs. SI-Adv 0.441; DGCNN/ShapeNet Part Curv: Ours 2.521 vs. GeoA3 1.695 and SI-Adv 2.054), the proposed method is not the best. The sentence 'surpasses these state-of-the-art methods across the majority of metrics' should be replaced with a precise count or a per-matrix summary of where the method wins and loses.
  2. [Section IV-B] The arrow notation '- - - →' used in Eqs. (1), (6), and (7) is not defined and appears visually broken. Define the unit perturbation direction vector explicitly and use a standard notation such as bold d_i throughout.
  3. [Section V-A] The weighting hyperparameter θ=0.5 is fixed without sensitivity analysis. A short ablation over θ (e.g., 0.1, 0.5, 1.0) would strengthen the claim that the method is robust to this choice.
  4. [Section III, Eq. (2)] The preliminary formulation in Eq. (2) sets up a joint optimization over σ and d, but the subsequent method does not directly use this objective; clarify the relationship between Eq. (2) and the IFGM-based iterative procedure.
  5. [Table II caption] The labels 'w/ -' and 'w/ +' are not explained in the caption; define 'reverse' and 'forward' explicitly so the reader can interpret the ablation without referring to the main text.
  6. [Section I] The claim of being 'the first to attribute the inadequate imperceptibility ... to deviation from the underlying surface' may conflict with the related work, including [33] and [26], which already discuss surface- and normal-aware perturbation directions; please either nuance the novelty claim or justify it with a specific comparison.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the P2S field is a learned external component, and the imperceptibility metrics are not used as training objectives.

full rationale

The paper's derivation chain is self-contained and not circular. The P2S field is learned from a denoising objective following [36] (Cai et al.), i.e., by regressing ground-truth gradients of the log-density of the shape distribution; it is not trained or tuned against the six imperceptibility metrics (CD, HD, l2, GR, Curv, EMD). The attack update in Eq. (6)-(7) uses the field only to reweight the perturbation direction, while the perturbation magnitude is determined following [31]; no equation in the paper defines the imperceptibility metrics as a function of the field by construction. Evaluation controls ASR at 100% for all methods and compares distortion under this common condition, so the reported improvements are empirical rather than forced by a fitted parameter. The self-citations in the reference list ([25]-[28], [43]-[44]) are related-work and evaluation-setting references, not load-bearing premises; the central premise (surface deviation causes perceptibility) is supported by external citation [11], and the field-learning method is external [36]. No passage in the manuscript asserts a limitation or missing proof that would indicate a circular step. Therefore no significant circularity is found.

Assumptions & free parameters 3 free parameters · 4 assumptions · 1 invented entities

The central claim rests on the learned P2S field being an accurate proxy for the underlying surface. The paper does not provide the network architecture, training data, or per-shape verification, so the field is effectively a free input with a domain assumption that such a field can be learned from noisy point clouds. The fixed hyperparameter theta=0.5 is a free choice with no sensitivity analysis.

free parameters (3)
  • theta (weighting hyperparameter) = 0.5
    Controls the strength of the P2S field adjustment in Eq. (6); set to 0.5 without reported sensitivity analysis.
  • Perturbation magnitude schedule = not specified
    The magnitude step is delegated to [31]; the exact schedule and iteration count are not defined in the paper, making the attack configuration a free choice.
  • Denoising network hyperparameters = not specified
    The P2S field network is trained 'following [36]', but architecture, learning rate, and training data splits are not provided, so the resulting field is effectively a free input.
assumptions (4)
  • domain assumption The gradient field of the log-density, gradient of log Q_s(q), points toward the surface S
    Used in Section IV-A, Eq. (5); assumes that the learned score function is a reliable estimate of the true surface normal direction for any query point.
  • domain assumption The density Q_s concentrates near the surface S
    Section IV-A; the entire P2S field construction relies on the density of points being highest on the surface, so points can be dragged toward it.
  • domain assumption Points on the surface remain imperceptible even with slightly larger displacement
    Introduction and Section III; this motivates the whole approach and justifies the relaxation of displacement constraints.
  • domain assumption The denoising network trained following [36] generalizes to the test shapes in ModelNet40 and ShapeNet Part
    Section IV-A and Section V; the field is evaluated on these datasets without per-shape fine-tuning.
invented entities (1)
  • Point-to-surface (P2S) field
    purpose: Adjusts adversarial perturbation directions by dragging points back to the underlying surface
    The P2S field is a learned function F(q) = gradient of log Q_s(q), introduced by the paper; it is not an independently observable quantity and its accuracy depends on the training procedure.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Imperceptible Adversarial Attacks on Point Clouds Guided by Point-to-Surface Field." pith.science (2026). https://pith.science/paper/5JB4TOFI

@misc{pith2026241219015,
  author       = {Pith},
  title        = {Pith review of: Imperceptible Adversarial Attacks on Point Clouds Guided by Point-to-Surface Field},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5JB4TOFI}},
  note         = {Machine review of arXiv:2412.19015}
}
read the original abstract

Adversarial attacks on point clouds are crucial for assessing and improving the adversarial robustness of 3D deep learning models. Traditional solutions strictly limit point displacement during attacks, making it challenging to balance imperceptibility with adversarial effectiveness. In this paper, we attribute the inadequate imperceptibility of adversarial attacks on point clouds to deviations from the underlying surface. To address this, we introduce a novel point-to-surface (P2S) field that adjusts adversarial perturbation directions by dragging points back to their original underlying surface. Specifically, we use a denoising network to learn the gradient field of the logarithmic density function encoding the shape's surface, and apply a distance-aware adjustment to perturbation directions during attacks, thereby enhancing imperceptibility. Extensive experiments show that adversarial attacks guided by our P2S field are more imperceptible, outperforming state-of-the-art methods.

Figures

Figures reproduced from arXiv: 2412.19015 by the authors.

Figure 1
Figure 1. Illustration of our point-to-surface (P2S) field-guided [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Visualizations of original and adversarial point clouds generated to fool PointNet on ModelNet40 by various adversarial [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Visualization of adversarial point clouds generated by various attack methods in attacking PointNet, with and without [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 27 canonical work pages

  1. [36]

    Learning gradient fields for shape generation,

    R. Cai, G. Yang, H. Averbuch-Elor, Z. Hao, S. Belongie, N. Snavely, and B. Hariharan, “Learning gradient fields for shape generation,” in ECCV, 2020, pp. 364–381

    work page 2020

  2. [31]

    Imperceptible transfer attack and defense on 3d point cloud classification,

    D. Liu and W. Hu, “Imperceptible transfer attack and defense on 3d point cloud classification,” IEEE TPAMI, vol. 45, no. 4, pp. 4727–4746, 2023

    work page 2023

  3. [1]

    Deep learning,

    Y . LeCun, Y . Bengio, and G. Hinton, “Deep learning,” Nature, vol. 521, no. 7553, pp. 436–444, 2015

    2015

  4. [2]

    Decision fusion networks for image classification,

    K. Tang, Y . Ma, D. Miao, P. Song, Z. Gu, Z. Tian, and W. Wang, “Decision fusion networks for image classification,” IEEE TNNLS , pp. 1–14, 2022

    work page 2022

  5. [3]

    Deep learning for 3d point clouds: A survey,

    Y . Guo, H. Wang, Q. Hu, H. Liu, L. Liu, and M. Bennamoun, “Deep learning for 3d point clouds: A survey,” IEEE TPAMI, vol. 43, no. 12, pp. 4338–4364, 2020

    work page 2020

  6. [4]

    Deep learning advances in computer vision with 3d data: A survey,

    A. Ioannidou, E. Chatzilari, S. Nikolopoulos, and I. Kompatsiaris, “Deep learning advances in computer vision with 3d data: A survey,” ACM computing surveys (CSUR) , vol. 50, no. 2, pp. 1–38, 2017

    2017

  7. [5]

    Reppvconv: attentively fusing reparameterized voxel features for efficient 3d point cloud perception,

    K. Tang, Y . Chen, W. Peng, Y . Zhang, M. Fang, Z. Wang, and P. Song, “Reppvconv: attentively fusing reparameterized voxel features for efficient 3d point cloud perception,” The Visual Computer , vol. 39, no. 11, pp. 5577–5588, 2023

    work page 2023

  8. [6]

    Generating 3d adversarial point clouds,

    C. Xiang, C. R. Qi, and B. Li, “Generating 3d adversarial point clouds,” in CVPR, 2019, pp. 9136–9144

    2019

Show all 47 references
  1. [7]

    Extending adversarial attacks and defenses to deep 3d point cloud classifiers,

    D. Liu, R. Yu, and H. Su, “Extending adversarial attacks and defenses to deep 3d point cloud classifiers,” in ICIP, 2019, pp. 2279–2283

    2019

  2. [8]

    Enhancing ad- versarial robustness via anomaly-aware adversarial training,

    K. Tang, T. Lou, X. He, Y . Shi, P. Zhu, and Z. Gu, “Enhancing ad- versarial robustness via anomaly-aware adversarial training,” in KSEM, 2023, pp. 328–342

    2023

  3. [9]

    Improving adversarial transferability through hybrid augmentation,

    P. Zhu, Z. Fan, S. Guo, K. Tang, and X. Li, “Improving adversarial transferability through hybrid augmentation,” Computers & Security , p. 103674, 2023

    2023

  4. [10]

    Effective single-step adversarial training with energy-based models,

    K. Tang, T. Lou, W. Peng, N. Chen, Y . Shi, and W. Wang, “Effective single-step adversarial training with energy-based models,” TETCI, vol. 8, no. 5, pp. 3396–3407, 2024

    2024

  5. [11]

    Learning graph- convolutional representations for point cloud denoising,

    F. Pistilli, G. Fracastoro, D. Valsesia, and E. Magli, “Learning graph- convolutional representations for point cloud denoising,” inECCV, 2020, pp. 103–118

    2020

  6. [12]

    Hept attack: Heuristic perpendicular trial for hard-label attacks under limited query budgets,

    Q. Li, X. Li, X. Cui, K. Tang, and P. Zhu, “Hept attack: Heuristic perpendicular trial for hard-label attacks under limited query budgets,” in CIKM, 2023, pp. 4064–4068

    2023

  7. [13]

    Sgma: a novel adversarial attack approach with improved transferability,

    P. Zhu, J. Hong, X. Li, K. Tang, and Z. Wang, “Sgma: a novel adversarial attack approach with improved transferability,” Complex & Intelligent Systems, pp. 1–13, 2023

    2023

  8. [14]

    A general black- box adversarial attack on graph-based fake news detectors,

    P. Zhu, Z. Pan, Y . Liu, J. Tian, K. Tang, and Z. Wang, “A general black- box adversarial attack on graph-based fake news detectors,” in IJCAI, 2024, pp. 568–576

    2024

  9. [15]

    Enhancing adversarial transferability with local transformation,

    Y . Zhang, J. Hong, Q. Bai, H. Liang, P. Zhu, and Q. Song, “Enhancing adversarial transferability with local transformation,” Complex & Intel- ligent Systems , vol. 11, no. 4, pp. 1–13, 2024

    2024

  10. [16]

    Dba: An efficient approach to boost transfer-based adversarial attack performance through information deletion,

    Z. Fan, P. Zhu, C. Gao, J. Hong, and K. Tang, “Dba: An efficient approach to boost transfer-based adversarial attack performance through information deletion,” in KSEM, 2023, p. 276–288

    2023

  11. [17]

    Hypergraph attacks via injecting homogeneous nodes into elite hyperedges,

    M. He, P. Zhu, K. Tang, and Y . Guo, “Hypergraph attacks via injecting homogeneous nodes into elite hyperedges,” in AAAI, 2025

    2025

  12. [18]

    Node injection attack based on label propagation against graph neural network,

    P. Zhu, Z. Pan, K. Tang, X. Cui, J. Wang, and Q. Xuan, “Node injection attack based on label propagation against graph neural network,” TCSS, vol. 11, no. 5, pp. 5858–5870, 2024

    2024

  13. [19]

    Pointcloud saliency maps,

    T. Zheng, C. Chen, J. Yuan, B. Li, and K. Ren, “Pointcloud saliency maps,” in ICCV, 2019, pp. 1598–1606

    2019

  14. [20]

    Adversarial attack and defense on point sets,

    J. Yang, Q. Zhang, R. Fang, B. Ni, J. Liu, and Q. Tian, “Adversarial attack and defense on point sets,” arXiv preprint arXiv:1902.10899 , 2019

    1902 arXiv

  15. [21]

    Robustness of 3d deep learning in an adversarial setting,

    M. Wicker and M. Kwiatkowska, “Robustness of 3d deep learning in an adversarial setting,” in CVPR, 2019, pp. 11 767–11 775

    2019

  16. [22]

    Td-net: Topology destruction network for generating adversarial point cloud,

    J. Zhang, C. Jiang, X. Wang, and M. Cai, “Td-net: Topology destruction network for generating adversarial point cloud,” inICIP, 2021, pp. 3098– 3102

    2021

  17. [23]

    On isometry robustness of deep 3d point cloud models under adversarial attacks,

    Y . Zhao, Y . Wu, C. Chen, and A. Lim, “On isometry robustness of deep 3d point cloud models under adversarial attacks,” in CVPR, 2020, pp. 1201–1210

    2020

  18. [24]

    Minimal adversarial examples for deep learning on 3d point clouds,

    J. Kim, B.-S. Hua, T. Nguyen, and S.-K. Yeung, “Minimal adversarial examples for deep learning on 3d point clouds,” in ICCV, 2021, pp. 7797–7806

    2021

  19. [25]

    Symattack: Symmetry-aware imperceptible adversarial attacks on 3d point clouds,

    K. Tang, Z. Wang, W. Peng, L. Huang, L. Wang, P. Zhu, W. Wang, and Z. Tian, “Symattack: Symmetry-aware imperceptible adversarial attacks on 3d point clouds,” in ACM Multimedia, 2024

    2024

  20. [26]

    Flat: Flux-aware imperceptible adversarial attacks on 3d point clouds,

    K. Tang, L. Huang, W. Peng, D. Liu, X. Wang, Y . Ma, L. Liu, and Z. Tian, “Flat: Flux-aware imperceptible adversarial attacks on 3d point clouds,” in ECCV, 2024, pp. 198–215

    2024

  21. [27]

    Eia: Edge- aware imperceptible adversarial attacks on 3d point clouds,

    Z. Wang, W. Peng, L. Wang, Z. Wu, P. Zhu, and K. Tang, “Eia: Edge- aware imperceptible adversarial attacks on 3d point clouds,” in MMM, 2025

    2025

  22. [28]

    Imper- ceptible 3d point cloud attacks on lattice-based barycentric coordinates,

    K. Tang, Z. Du, W. Peng, X. Wang, D. Liu, L. Liu, and Z. Tian, “Imper- ceptible 3d point cloud attacks on lattice-based barycentric coordinates,” in AAAI, 2025

    2025

  23. [29]

    Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep networks,

    H. Zhou, D. Chen, J. Liao, K. Chen, X. Dong, K. Liu, W. Zhang, G. Hua, and N. Yu, “Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep networks,” in CVPR, 2020, pp. 10 356–10 365

    2020

  24. [30]

    Geometry-aware generation of adversarial point clouds,

    Y . Wen, J. Lin, K. Chen, C. P. Chen, and K. Jia, “Geometry-aware generation of adversarial point clouds,” IEEE TPAMI, vol. 44, no. 6, pp. 2984–2999, 2022

    2022

  25. [32]

    Shape- invariant 3d adversarial point clouds,

    Q. Huang, X. Dong, D. Chen, H. Zhou, W. Zhang, and N. Yu, “Shape- invariant 3d adversarial point clouds,” in CVPR, 2022, pp. 15 335– 15 344

    2022

  26. [33]

    Rethinking perturbation directions for imperceptible adversarial attacks on point clouds,

    K. Tang, Y . Shi, T. Lou, W. Peng, X. He, P. Zhu, Z. Gu, and Z. Tian, “Rethinking perturbation directions for imperceptible adversarial attacks on point clouds,” IEEE Internet of Things Journal , vol. 10, no. 6, pp. 5158–5169, 2023

    2023

  27. [34]

    Poisson surface reconstruc- tion,

    M. Kazhdan, M. Bolitho, and H. Hoppe, “Poisson surface reconstruc- tion,” in SGP, vol. 7, no. 4, 2006

    2006

  28. [35]

    Deepsdf: Learning continuous signed distance functions for shape representation,

    J. J. Park, P. Florence, J. Straub, R. Newcombe, and S. Lovegrove, “Deepsdf: Learning continuous signed distance functions for shape representation,” in CVPR, 2019, pp. 165–174

    2019

  29. [37]

    Self-robust 3d point recognition via gather-vector guidance,

    X. Dong, D. Chen, H. Zhou, G. Hua, W. Zhang, and N. Yu, “Self-robust 3d point recognition via gather-vector guidance,” in CVPR, 2020, pp. 11 513–11 521

    2020

  30. [38]

    3d shapenets: A deep representation for volumetric shapes,

    Z. Wu, S. Song, A. Khosla, F. Yu, L. Zhang, X. Tang, and J. Xiao, “3d shapenets: A deep representation for volumetric shapes,” in CVPR, 2015, pp. 1912–1920

    2015

  31. [39]

    Shapenet: An information- rich 3d model repository,

    A. X. Chang, T. Funkhouser, L. Guibas, P. Hanrahan, Q. Huang, Z. Li, S. Savarese, M. Savva, S. Song, H. Su et al., “Shapenet: An information- rich 3d model repository,” arXiv preprint arXiv:1512.03012 , 2015

    2015 arXiv

  32. [40]

    Pointnet: Deep learning on point sets for 3d classification and segmentation,

    C. R. Qi, H. Su, K. Mo, and L. J. Guibas, “Pointnet: Deep learning on point sets for 3d classification and segmentation,” in CVPR, 2017, pp. 652–660

    2017

  33. [41]

    Dynamic graph cnn for learning on point clouds,

    Y . Wang, Y . Sun, Z. Liu, S. E. Sarma, M. M. Bronstein, and J. M. Solomon, “Dynamic graph cnn for learning on point clouds,” ACM TOG (SIGGRAPH), vol. 38, no. 5, pp. 1–12, 2019

    2019

  34. [42]

    Pointconv: Deep convolutional networks on 3d point clouds,

    W. Wu, Z. Qi, and L. Fuxin, “Pointconv: Deep convolutional networks on 3d point clouds,” in CVPR, 2019, pp. 9621–9630

    2019

  35. [43]

    Deep manifold attack on point clouds via parameter plane stretching,

    K. Tang, J. Wu, W. Peng, Y . Shi, P. Song, Z. Gu, Z. Tian, and W. Wang, “Deep manifold attack on point clouds via parameter plane stretching,” in AAAI, vol. 37, no. 2, 2023, pp. 2420–2428

    2023

  36. [44]

    Manifold constraints for imperceptible adversarial attacks on point clouds,

    K. Tang, X. He, W. Peng, J. Wu, Y . Shi, D. Liu, P. Zhou, W. Wang, and Z. Tian, “Manifold constraints for imperceptible adversarial attacks on point clouds,” in AAAI, vol. 38, no. 6, 2024, pp. 5127–5135

    2024

  37. [45]

    A point set generation network for 3d object reconstruction from a single image,

    H. Fan, H. Su, and L. J. Guibas, “A point set generation network for 3d object reconstruction from a single image,” in CVPR, 2017, pp. 605–613

    2017

  38. [46]

    Metrics for evaluating 3d medical image segmentation: analysis, selection, and tool,

    A. A. Taha and A. Hanbury, “Metrics for evaluating 3d medical image segmentation: analysis, selection, and tool,” BMC medical imaging , vol. 15, pp. 1–28, 2015

    2015

  39. [47]

    The earth mover’s distance as a metric for image retrieval,

    Y . Rubner, C. Tomasi, and L. J. Guibas, “The earth mover’s distance as a metric for image retrieval,” IJCV, vol. 40, pp. 99–121, 2000

    2000

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.