Pith. sign in

REVIEW 4 major objections 5 minor 48 references

KNN-Defense: Defense against 3D Adversarial Point Clouds using Nearest-Neighbor Search

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read KNN-Defense defends 3D point cloud classifiers by replacing the classifier's decision with a weighted vote among the k nearest training-set samples in feature space, improving accuracy against point-dropping, point-shifting, and…

desk verdict A clean, honest transfer of the 2D kNN defense to 3D point clouds that reports real gains against non-adaptive attacks, but the central robustness claim is not tested against an adversary that actually targets the kNN vote. read the letter →

arxiv 2506.06906 v1 pith:UZ27FAPZ submitted 2025-06-07 cs.CV

Nima Jamali , Matina Mahdizadeh Sani , Hanieh Naderi , Shohreh Kasaei This is my paper · ORCID
classification cs.CV
keywords 3Dpointcloudsadversarialdefenseattackmanifoldassumptionnearest-neighborsearchfeaturespaceModelNet40
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes KNN-Defense, a preprocessing defense for 3D point cloud classifiers that requires no retraining or architectural changes. Under the manifold assumption that clean point clouds form a low-dimensional structure while adversarial examples are displaced from it, the method projects each input back toward the manifold by finding the $k$ nearest training samples in the feature space of a pretrained network and aggregating their softmax outputs with one of three weighting functions. On ModelNet40, this restores accuracy under point-shifting, point-adding, and point-dropping attacks across PointNet, PointNet++, DGCNN, and PCT, with the largest gains on dropping attacks where many prior defenses fail. The method is lightweight, running in about 5.4 ms per cloud with uniform weighting, and generalizes across attack types without being tailored to a specific threat model.

What carries the argument

The machinery is the feature-space nearest-neighbor projection: for an input cloud $P$, extract the global feature vector $L(P)$ from a chosen layer of the pretrained classifier, compute distances $D(P, P')$ to all training clouds in that space, select the $k$ closest, and take the class that maximizes the weighted average of the neighbors' softmax vectors. One of three weighting functions assigns the weights: uniform weighting, entropy-based weighting (which up-weights confident softmax vectors), or diversity-based weighting (which up-weights vectors with a large gap between the top and next $M$ entries). This substitutes the empirical distribution of training features for the unknown data manifold, so the defense never needs to reconstruct the original surface.

What would settle it

Construct adversarial point clouds that optimize the attack objective to minimize feature-space distance to a wrong-class training centroid while staying within the perturbation budgets used in the paper; if such clouds flip the nearest-neighbor vote to the wrong class, then the manifold-projection assumption is violated and the defense collapses.

Watch

Extended reading notes

Core claim

The central claim is that adversarial perturbations displace a point cloud's feature representation from the clean-data manifold, and that projecting the adversarial input back onto that manifold can be approximated by a weighted vote over the $k$ nearest training-set neighbors in feature space. The paper demonstrates that this feature-space nearest-neighbor voting, with uniform, entropy-based, or diversity-based weighting, improves classification accuracy under point-shifting, point-adding, and point-dropping attacks on four standard 3D classifiers. Against point-dropping of 200 points on ModelNet40, KNN-Defense exceeds IF-Defense by 20.1, 3.6, 3.44, and 7.74 percentage points on PointNet, PointNet++, DGCNN, and PCT, respectively. The defense works by computing the global feature vector of the input, retrieving the $k$ closest training features, and returning the class that maximizes the weighted average of the neighbors' softmax vectors, with no geometric reconstruction or retraining.

Load-bearing premise

The defense assumes that an adversarial perturbation moves a point cloud's feature representation away from the clean-data manifold but still into a region where the $k$ nearest training-set neighbors vote for the correct class, so the pretrained feature extractor must preserve semantic similarity under attack.

Editorial extensions

If this is right

  • On ModelNet40 point-dropping attacks that remove 200 points, KNN-Defense outperforms IF-Defense by 20.1, 3.6, 3.44, and 7.74 percentage points on PointNet, PointNet++, DGCNN, and PCT.
  • The defense requires no retraining or architecture changes, so any pretrained point cloud classifier that exposes a feature layer can be wrapped with KNN-Defense as a preprocessing front-end.
  • The method is fast enough for near-real-time use: about 5.4 ms per cloud with uniform weighting, roughly six times faster than IF-Defense.
  • On the real-world ScanObjectNN dataset, the defended PCT model stays competitive and gives its largest gains on untargeted point-dropping attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Per-class nearest-neighbor label purity should predict where the defense succeeds: classes with sparse or scattered training features will get less reliable votes, so measuring purity per class would localize expected accuracy drops.
  • If the feature-space displacement of adversarial examples is small, an attack that directly optimizes feature distance to a wrong-class centroid could break the defense; testing such an attack would probe whether the manifold assumption holds in practice.
  • The confidence-weighting idea is general and could transfer beyond nearest-neighbor search, e.g., combining any feature-space denoiser with entropy- or diversity-based weighting in other 3D recognition tasks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes KNN-Defense, a training-free defense for 3D point cloud classifiers. For each input, the method extracts a feature vector from a pretrained network's aggregation layer, finds its k nearest neighbors among training-set feature vectors, computes the softmax outputs of those neighbors, and assigns the class by a weighted average of those softmax vectors. Three weighting schemes (uniform, entropy-based, diversity-based) are proposed. The method is evaluated on ModelNet40 and ScanObjectNN against point-shifting, point-adding, point-dropping, AdvPC, and AOF attacks, and is compared with SRS, SOR, DUP-Net, and IF-Defense across PointNet, PointNet++, DGCNN, and PCT. The main reported gains are under point-dropping attacks, where the method outperforms IF-Defense by several percentage points on all four architectures, while being computationally lightweight.

Significance. If the robustness gains are confirmed under a properly adaptive threat model, KNN-Defense would be a useful, architecture-agnostic, retraining-free defense component with a simple and fast inference procedure. The paper's strengths include an open-source implementation, evaluation across four architectures and several attack families, and a clear algorithmic description that makes the method easy to reproduce. However, the current evidence is limited to attacks that target the undefended classifier, and the defense's own decision mechanism—the feature-space nearest-neighbor vote—is never adversarially optimized. Since the method is essentially a non-parametric classifier built on a pretrained feature extractor, its security claim requires an adaptive evaluation. The claimed state-of-the-art status is also stronger than the tables support, because on PointNet++ and DGCNN the proposed method lags behind IF-Defense on most targeted attacks.

major comments (4)
  1. [Section 4.2, Tables 1–5] All reported attacks are generated against the undefended classification network, not against KNN-Defense. The defense's final decision is a weighted average of softmax outputs of k nearest training-set neighbors in feature space. A white-box adversary who knows the feature extractor and the training set can run a PGD/C&W-style optimization to bring the adversarial feature vector close to training samples of a target class, directly manipulating which neighbors are retrieved and how they vote. No such adaptive attack is reported, so the paper's central claim that KNN-Defense 'significantly improves robustness' is established only against adversaries that ignore the defense. The authors should add an adaptive evaluation, for example by optimizing the input to minimize the cross-entropy of the final weighted-average softmax (with a differentiable relaxation of the kNN selection) under the same perturbation budgets used in the paper, and report the resulting accuracies.
  2. [Section 4.1, Fig. 3] The hyperparameter k is selected using the same test set on which the final results in Tables 1–5 are reported, with no validation split or cross-validation. The statement 'As shown in Fig. 3, and based on the EW metric, the values selected were k=5 for PointNet, k=10 for PCT, and k=15 for PointNet++ and DGCNN' indicates that the test-set adversarial accuracy was used for model selection. This risks overfitting the defense to the specific test attack set and makes the comparison with baselines, whose hyperparameters are not tuned in the same way, potentially unfair. The authors should either use a separate validation split for selecting k or report sensitivity of the results to k across a range with error bars.
  3. [Section 4.2, Tables 1–5] The text claims state-of-the-art results against 'most targeted attacks' on PointNet and PCT, but the tables show that on PointNet++ and DGCNN the proposed method is often substantially worse than IF-Defense. For example, Table 2 reports Pert accuracy of 63.69 for Ours(EW) versus 89.16 for IF-Defense on PointNet++; Table 3 reports 73.47 for Ours(EW) versus 90.00 for IF-Defense on DGCNN. The average gains come from point-dropping attacks, not from a consistent improvement across all attack types. The central claim should be qualified to the attack types and architectures where the improvement actually holds, or the paper should report an aggregate metric (e.g., mean accuracy over attack types) with statistical significance tests.
  4. [Section 3.1 and Algorithm 1] The paper repeatedly describes the method as 'projecting adversarial inputs back onto the manifold' and 'restoring perturbed inputs,' but Algorithm 1 never reconstructs a point cloud; it only replaces the classifier's decision by a weighted kNN vote over training softmax vectors. This is not merely a wording issue: the defense's validity depends on the premise that the feature-space neighborhood of an attacked input contains mostly same-class training samples. The paper does not directly measure neighbor label purity or how often the kNN set changes under attack. Adding such an analysis (e.g., reporting the fraction of correct-class neighbors and the confidence of the vote) would substantiate the manifold assumption and help explain the empirical behavior.
minor comments (5)
  1. [Algorithm 1, lines 3–4] Line 3 writes d_i(P) = D(P, P'_i), but the distance is computed between feature vectors after applying L; it should be D(L(P), L(P'_i)) or the notation for D should be defined on feature space.
  2. [Introduction, Section 2.1] There is a typo in Section 2.1: 'an important res ce in many applications' should read 'an important resource in many applications.'
  3. [Abstract and Section 5] The abstract and conclusion state that the method 'restores perturbed inputs,' which overstates what the algorithm does. The method outputs a class label, not a restored point cloud; this should be reworded consistently.
  4. [Table 5] The ScanObjectNN results show that KNN-Defense is not consistently competitive with IF-Defense on targeted attacks (e.g., Pert: 46.67 for Ours(EW) versus 53.26 for IF-Defense). The discussion acknowledges this in passing, but the abstract and introduction should not claim general state-of-the-art robustness without mentioning this caveat.
  5. [Section 4.2.1] The runtime comparison would be more informative if it also reported the memory/storage overhead of the feature database and the time for feature extraction, since the method requires storing and searching the full training-set feature bank.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: KNN-Defense is an algorithmic defense evaluated against external attacks, and its reported gains do not reduce to its own inputs by construction.

full rationale

The paper's central claim is empirical: that projecting an input onto a feature-space manifold approximated by k training-set nearest neighbors, then aggregating their softmax outputs, improves robustness against point-dropping, point-shifting, and point-adding attacks. This is an algorithmic defense, not an equation-based prediction. The inputs to the method are the pretrained feature extractor, the training-set features, and the training labels; all of these are external to the attack-generation process. The final prediction is argmax of a weighted average of neighbor softmax vectors (Algorithm 1), and no equation in the paper defines the attack success metric in terms of the neighbor-voting mechanism, so there is no self-definitional reduction. Hyperparameter k is selected empirically in Section 4.1 using accuracy curves, but this is ordinary hyperparameter tuning; it is not a fitted parameter renamed as a prediction, and the comparison tables are not forced by that tuning in a derivation-theoretic sense, though test-set tuning would be a reproducibility concern. The method is explicitly adapted from Dubey et al. [46], an external prior work, not from a self-citation chain. There is no imported uniqueness theorem, no ansatz smuggled in via citation, and no known result merely renamed as a new organization. The absence of adaptive attacks that directly optimize against the neighbor-voting mechanism is a genuine robustness-evaluation limitation, but it is not circular reasoning. Accordingly, the correct circularity finding is a score of 0.

Assumptions & free parameters 3 free parameters · 2 assumptions · 0 invented entities

The method depends on two domain assumptions about the geometry of learned features, and on three free parameters tuned on the evaluation data. No new physical or mathematical entities are introduced.

free parameters (3)
  • k (number of nearest neighbors) = 5 (PointNet), 10 (PCT), 15 (PointNet++, DGCNN)
    Selected based on accuracy curves in Fig. 3, apparently on the test set, without a separate validation split (Section 4.1).
  • P (diversity weighting exponent) = 3
    Set in Section 3.2.3; no sensitivity analysis provided.
  • M (diversity weighting top-M count) = 20
    Set in Section 3.2.3; no justification other than experimental choice.
assumptions (2)
  • domain assumption Clean point clouds lie on a low-dimensional manifold, while adversarial examples are displaced from it.
    Stated in Section 3.1 as the core assumption; not empirically validated in the paper.
  • domain assumption Feature-space distances from the pretrained model reflect semantic similarity, so nearest neighbors share the correct label.
    Implied by Algorithm 1 and Fig. 2; no proof or analysis that this holds under adversarial perturbation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of KNN-Defense: Defense against 3D Adversarial Point Clouds using Nearest-Neighbor Search." pith.science (2026). https://pith.science/paper/UZ27FAPZ

@misc{pith2026250606906,
  author       = {Pith},
  title        = {Pith review of: KNN-Defense: Defense against 3D Adversarial Point Clouds using Nearest-Neighbor Search},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UZ27FAPZ}},
  note         = {Machine review of arXiv:2506.06906}
}
read the original abstract

Deep neural networks (DNNs) have demonstrated remarkable performance in analyzing 3D point cloud data. However, their vulnerability to adversarial attacks-such as point dropping, shifting, and adding-poses a critical challenge to the reliability of 3D vision systems. These attacks can compromise the semantic and structural integrity of point clouds, rendering many existing defense mechanisms ineffective. To address this issue, a defense strategy named KNN-Defense is proposed, grounded in the manifold assumption and nearest-neighbor search in feature space. Instead of reconstructing surface geometry or enforcing uniform point distributions, the method restores perturbed inputs by leveraging the semantic similarity of neighboring samples from the training set. KNN-Defense is lightweight and computationally efficient, enabling fast inference and making it suitable for real-time and practical applications. Empirical results on the ModelNet40 dataset demonstrated that KNN-Defense significantly improves robustness across various attack types. In particular, under point-dropping attacks-where many existing methods underperform due to the targeted removal of critical points-the proposed method achieves accuracy gains of 20.1%, 3.6%, 3.44%, and 7.74% on PointNet, PointNet++, DGCNN, and PCT, respectively. These findings suggest that KNN-Defense offers a scalable and effective solution for enhancing the adversarial resilience of 3D point cloud classifiers. (An open-source implementation of the method, including code and data, is available at https://github.com/nimajam41/3d-knn-defense).

Figures

Figures reproduced from arXiv: 2506.06906 by the authors.

Figure 1
Figure 1. Manifold assumption in KNN-Defense. Clean point clouds are assumed to lie on an n-dimensional manifold, while adversarial examples deviate from it. The proposed method projects adversarial inputs back onto the manifold for robust classification, using nearest neighbors. However, what makes 3D attacks unique is the emergence of new types of attacks based on the intrinsic properties of point clouds. In the context of … view at source ↗
Figure 2
Figure 2. Pipeline of proposed 3D KNN-Defense method. It involves finding the k nearest neighbors of a given input in the point cloud database based on the distance between the global feature vectors. The weighted average of the neighbors’ softmax vectors is used to predict the final class label. data from adversarial point clouds using probabilistic diffusion models [13]. It first estimates each point’s perturbation to gauge… view at source ↗
Figure 3
Figure 3. Accuracy of different classification models against various attacks, considering different values of k, using the EW metric as the weighting function [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 39 canonical work pages

  1. [1]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recogni- tion. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770–778 (2016)

    2016

  2. [2]

    In: International Conference on Machine Learning, pp

    Tan, M., Le, Q.: Efficientnet: Rethinking model scaling for convolutional neu- ral networks. In: International Conference on Machine Learning, pp. 6105–6114 (2019). PMLR

    2019

  3. [3]

    International conference on learning representations (2021)

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al.: An image is worth 16x16 words: Transformers for image recognition at scale. International conference on learning representations (2021)

    work page 2021

  4. [4]

    In: Proceed- ings of the European Conference on Computer Vision (ECCV), pp

    Chen, L.-C., Zhu, Y., Papandreou, G., Schroff, F., Adam, H.: Encoder-decoder with atrous separable convolution for semantic image segmentation. In: Proceed- ings of the European Conference on Computer Vision (ECCV), pp. 801–818 (2018)

    work page 2018

  5. [5]

    Advances in Neural Information Processing Systems34, 12077–12090 (2021)

    Xie, E., Wang, W., Yu, Z., Anandkumar, A., Alvarez, J.M., Luo, P.: Seg- former: Simple and efficient design for semantic segmentation with transformers. Advances in Neural Information Processing Systems34, 12077–12090 (2021)

    2021

  6. [6]

    In: The Eleventh International Conference on Learning Representations (2022)

    Chen, Z., Duan, Y., Wang, W., He, J., Lu, T., Dai, J., Qiao, Y.: Vision trans- former adapter for dense predictions. In: The Eleventh International Conference on Learning Representations (2022)

    work page 2022

  7. [7]

    In: 2nd International Conference on Learning Representations, ICLR 2014 (2014)

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fer- gus, R.: Intriguing properties of neural networks. In: 2nd International Conference on Learning Representations, ICLR 2014 (2014)

    work page 2014

  8. [8]

    In: International Conference on Learning Representations (2015)

    Goodfellow, I., Shlens, J., Szegedy, C.: Explaining and harnessing adversar- ial examples. In: International Conference on Learning Representations (2015). http://arxiv.org/abs/1412.6572 13

    arXiv 2015

Show all 48 references
  1. [9]

    Multimedia Tools and Applications81(15), 21919–21938 (2022)

    Naderi, H., Goli, L., Kasaei, S.: Generating unrestricted adversarial examples via three parameteres. Multimedia Tools and Applications81(15), 21919–21938 (2022)

    2022

  2. [10]

    In: 2016 IEEE European Symposium on Security and Privacy (EuroS&P), pp

    Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.: The limitations of deep learning in adversarial settings. In: 2016 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 372–387 (2016). IEEE

    2016

  3. [11]

    International Conference on Learning Representations (2018)

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learn- ing models resistant to adversarial attacks. International Conference on Learning Representations (2018)

    2018

  4. [12]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp

    Moosavi-Dezfooli, S.-M., Fawzi, A., Frossard, P.: Deepfool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2574–2582 (2016)

    2016

  5. [13]

    In: 2017 Ieee Symposium on Security and Privacy (sp), pp

    Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 Ieee Symposium on Security and Privacy (sp), pp. 39–57 (2017). Ieee

    2017

  6. [14]

    In: International Conference on Learning Representations (2018)

    He, W., Li, B., Song, D.: Decision boundary analysis of adversarial examples. In: International Conference on Learning Representations (2018)

    2018

  7. [15]

    IEEE Transactions on Evolutionary Computation23(5), 828–841 (2019)

    Su, J., Vargas, D.V., Sakurai, K.: One pixel attack for fooling deep neu- ral networks. IEEE Transactions on Evolutionary Computation23(5), 828–841 (2019)

    2019

  8. [16]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Rahmati, A., Moosavi-Dezfooli, S.-M., Frossard, P., Dai, H.: Geoda: a geometric framework for black-box adversarial attacks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8446–8455 (2020)

    2020

  9. [17]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp

    Zhou, Y., Tuzel, O.: Voxelnet: End-to-end learning for point cloud based 3d object detection. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4490–4499 (2018)

    2018

  10. [18]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp

    Shi, S., Wang, X., Li, H.: Pointrcnn: 3d object proposal generation and detection from point cloud. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770–779 (2019)

    2019

  11. [19]

    In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp

    Mei, G., Poiesi, F., Saltori, C., Zhang, J., Ricci, E., Sebe, N.: Overlap-guided gaussian mixture models for point cloud registration. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 4511– 4520 (2023)

    2023

  12. [20]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Qin, Z., Yu, H., Wang, C., Guo, Y., Peng, Y., Xu, K.: Geometric transformer for fast and robust point cloud registration. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 11143–11152 (2022) 14

    2022

  13. [21]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp

    Qi, C.R., Su, H., Mo, K., Guibas, L.J.: Pointnet: Deep learning on point sets for 3d classification and segmentation. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 652–660 (2017)

    2017

  14. [22]

    Advances in neural information processing systems30(2017)

    Qi, C.R., Yi, L., Su, H., Guibas, L.J.: Pointnet++: Deep hierarchical feature learning on point sets in a metric space. Advances in neural information processing systems30(2017)

    2017

  15. [23]

    ACM Transactions on Graphics (tog)38(5), 1–12 (2019)

    Wang, Y., Sun, Y., Liu, Z., Sarma, S.E., Bronstein, M.M., Solomon, J.M.: Dynamic graph cnn for learning on point clouds. ACM Transactions on Graphics (tog)38(5), 1–12 (2019)

    2019

  16. [24]

    Computational Visual Media7, 187–199 (2021)

    Guo, M.-H., Cai, J.-X., Liu, Z.-N., Mu, T.-J., Martin, R.R., Hu, S.-M.: Pct: Point cloud transformer. Computational Visual Media7, 187–199 (2021)

    2021

  17. [25]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp

    Xiang, T., Zhang, C., Song, Y., Yu, J., Cai, W.: Walk in the cloud: Learning curves for point clouds shape analysis. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 915–924 (2021)

    2021

  18. [26]

    In: Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Xiang, C., Qi, C.R., Li, B.: Generating 3d adversarial point clouds. In: Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9136–9144 (2019)

    2019

  19. [27]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp

    Zheng, T., Chen, C., Yuan, J., Li, B., Ren, K.: Pointcloud saliency maps. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 1598–1606 (2019)

    2019

  20. [28]

    In: Computer Vision–ECCV 2020: 16th Euro- pean Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XII 16, pp

    Hamdi, A., Rojas, S., Thabet, A., Ghanem, B.: Advpc: Transferable adversarial perturbations on 3d point clouds. In: Computer Vision–ECCV 2020: 16th Euro- pean Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XII 16, pp. 241–257 (2020). Springer

    2020

  21. [29]

    arXiv preprint arXiv:2210.14164 (2022)

    Naderi, H., Dinesh, C., Bajic, I.V., Kasaei, S.: Model-free prediction of adversarial drop points in 3d point clouds. arXiv preprint arXiv:2210.14164 (2022)

    2022 arXiv

  22. [30]

    In: 2023 6th International Conference on Pattern Recognition and Image Analysis (IPRIA), pp

    Arya, A., Naderi, H., Kasaei, S.: Adversarial attack by limited point cloud surface modifications. In: 2023 6th International Conference on Pattern Recognition and Image Analysis (IPRIA), pp. 1–8 (2023). IEEE

    2023

  23. [31]

    IEEE Access11, 144274–144295 (2023)

    Naderi, H., Baji´ c, I.V.: Adversarial attacks and defenses on 3d point cloud classification: A survey. IEEE Access11, 144274–144295 (2023)

    2023

  24. [32]

    In: Proceedings of the AAAI Conference on Artificial Intelligence, vol

    Tsai, T., Yang, K., Ho, T.-Y., Jin, Y.: Robust adversarial objects against deep learning models. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, pp. 954–962 (2020)

    2020

  25. [33]

    In: 2021 IEEE Symposium on Security and Privacy (SP), pp

    Cao, Y., Wang, N., Xiao, C., Yang, D., Fang, J., Yang, R., Chen, Q.A., Liu, M., 15 Li, B.: Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks. In: 2021 IEEE Symposium on Security and Privacy ...

    2021

  26. [34]

    In: 2019 IEEE International Conference on Image Processing (ICIP), pp

    Liu, D., Yu, R., Su, H.: Extending adversarial attacks and defenses to deep 3d point cloud classifiers. In: 2019 IEEE International Conference on Image Processing (ICIP), pp. 2279–2283 (2019). IEEE

    2019

  27. [35]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp

    Zhou, H., Chen, K., Zhang, W., Fang, H., Zhou, W., Yu, N.: Dup-net: Denoiser and upsampler network for 3d adversarial point clouds defense. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 1961–1970 (2019)

    2019

  28. [36]

    arXiv preprint arXiv:2010.05272 (2020)

    Wu, Z., Duan, Y., Wang, H., Fan, Q., Guibas, L.J.: If-defense: 3d adversar- ial point cloud defense via implicit function based restoration. arXiv preprint arXiv:2010.05272 (2020)

    2020 arXiv

  29. [37]

    Plos one18(2), 0271388 (2023)

    Naderi, H., Noorbakhsh, K., Etemadi, A., Kasaei, S.: Lpf-defense: 3d adversarial defense based on frequency analysis. Plos one18(2), 0271388 (2023)

    2023

  30. [38]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp

    Yu, L., Li, X., Fu, C.-W., Cohen-Or, D., Heng, P.-A.: Pu-net: Point cloud upsam- pling network. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2790–2799 (2018)

    2018

  31. [39]

    arXiv preprint arXiv:2005.11626 (2020)

    Lee, K., Chen, Z., Yan, X., Urtasun, R., Yumer, E.: Shapeadv: Generating shape- aware adversarial 3d point clouds. arXiv preprint arXiv:2005.11626 (2020)

    2020 arXiv

  32. [40]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Zhou, H., Chen, D., Liao, J., Chen, K., Dong, X., Liu, K., Zhang, W., Hua, G., Yu, N.: Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep networks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognitio...

    2020

  33. [41]

    IEEE Access10, 50974–50984 (2022)

    Liu, B., Zhang, J., Zhu, J.: Boosting 3d adversarial attacks with attacking on frequency. IEEE Access10, 50974–50984 (2022)

    2022

  34. [42]

    arXiv preprint arXiv:1902.10899 (2019)

    Yang, J., Zhang, Q., Fang, R., Ni, B., Liu, J., Tian, Q.: Adversarial attack and defense on point sets. arXiv preprint arXiv:1902.10899 (2019)

    2019 arXiv

  35. [43]

    IEEE Transactions on Information Forensics and Security18, 3267–3276 (2023)

    Zhang, J., Dong, Y., Kuang, M., Liu, B., Ouyang, B., Zhu, J., Wang, H., Meng, Y.: The art of defense: Letting networks fool the attacker. IEEE Transactions on Information Forensics and Security18, 3267–3276 (2023)

    2023

  36. [44]

    In: Proceedings of the 31st ACM International Conference on Multimedia, pp

    Zhang, K., Zhou, H., Zhang, J., Huang, Q., Zhang, W., Yu, N.: Ada3diff: Defend- ing against 3d adversarial point clouds via adaptive diffusion. In: Proceedings of the 31st ACM International Conference on Multimedia, pp. 8849–8859 (2023)

    2023

  37. [45]

    Neurocomputing505, 58–67 (2022)

    Zhang, J., Chen, L., Ouyang, B., Liu, B., Zhu, J., Chen, Y., Meng, Y., 16 Wu, D.: Pointcutmix: Regularization strategy for point cloud classification. Neurocomputing505, 58–67 (2022)

    2022

  38. [46]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp

    Dubey, A., Maaten, L.v.d., Yalniz, Z., Li, Y., Mahajan, D.: Defense against adversarial images using web-scale nearest-neighbor search. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8767–8776 (2019)

    2019

  39. [47]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp

    Wu, Z., Song, S., Khosla, A., Yu, F., Zhang, L., Tang, X., Xiao, J.: 3d shapenets: A deep representation for volumetric shapes. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1912–1920 (2015)

    2015

  40. [48]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp

    Uy, M.A., Pham, Q.-H., Hua, B.-S., Nguyen, T., Yeung, S.-K.: Revisiting point cloud classification: A new benchmark dataset and classification model on real- world data. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 1588–1597 (2019) 17

    2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.