Pith. sign in

REVIEW 4 major objections 6 minor 69 references

Cage-Based Deformation for Transferable and Undefendable Point Cloud Attack

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Attacking a 3D point cloud by deforming an enclosing cage, rather than moving points directly, yields adversarial shapes that look natural and still transfer across classifiers and resist defenses.

desk verdict CageAttack is a real new attack with broad experiments, but its 'superior plausibility' claim rests on unvalidated metrics and a 10-person study. read the letter →

arxiv 2507.00690 v1 pith:4CCCTVQQ submitted 2025-07-01 cs.CV cs.CR

Keke Tang , Ziyong Du , Weilong Peng , Xiaofei Wang , Peican Zhu , Ligang Liu , Zhihong Tian This is my paper · ORCID
classification cs.CVcs.CR
keywords adversarialattackspointcloudscage-baseddeformationtransferabilityundefendabilityplausibilitymeanvaluecoordinates3Ddeeplearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes CageAttack, a method for generating adversarial point clouds that mislead 3D deep learning classifiers while remaining plausible to human observers. The central claim is that perturbing an enclosing cage, rather than individual points, produces smooth, natural-looking deformations that keep attack success high while improving transferability across models and resistance to defenses. The authors argue that existing deformation attacks either impose rigid imperceptibility constraints that limit transferability or produce unstructured distortions that are visually conspicuous. CageAttack's cage construction—subdivision driven by curvature and density, followed by vertex optimization—provides a structured, shape-aware control basis for the deformation. If the claim holds, adversarial point cloud attacks can be both effective and perceptually inconspicuous without sacrificing generalization or robustness.

What carries the argument

The cage is the central object: a closed triangular mesh enclosing the point cloud, refined by subdividing tetrahedra based on point-cloud curvature and density and then optimizing vertex positions to conform to the surface while keeping faces smooth and evenly sized. The point cloud is expressed as convex combinations of cage vertices via mean value coordinates, so perturbing cage vertices is a structured, low-dimensional handle on the whole shape. The optimization objective is misclassification loss plus a Chamfer-distance imperceptibility penalty between the original and deformed point clouds, solved in the style of the optimization attack the paper builds on. The cage's structure carries the argument: it globalizes the deformation, prevents pointwise outliers, and keeps changes intrinsic to the object's geometry.

What would settle it

Run a large, preregistered forced-choice user study comparing CageAttack outputs with HiT-ADV and Mani-ADV outputs at matched attack success rates, using a diverse pool of raters; if human raters do not systematically prefer CageAttack's shapes as the most natural, the paper's central balance claim is falsified.

Watch

Extended reading notes

Core claim

The discovery is that cage-based deformation yields a better balance among transferability, undefendability, and plausibility for adversarial point cloud attacks. Instead of moving points directly, the method fits a cage around the object, refines it via curvature- and density-aware subdivision and vertex optimization, and then perturbs cage vertices through an optimization that minimizes misclassification plus a Chamfer-distance penalty. Perturbations propagate to the point cloud through mean value coordinates, so the deformation remains smooth and intrinsic to the shape. On seven classifiers across three datasets, CageAttack reaches near-100 percent attack success while scoring lowest or near-lowest on five naturalness metrics (CSD, curvature, uniformity, KNN distance, Laplacian loss) among deformation methods, and it keeps competitive transferability and undefendability, particularly surviving the strong IF-Defense with substantially higher success than most baselines.

Load-bearing premise

The central plausibility claim rests on five geometric smoothness metrics plus a small user study, and the deformation's smoothness is assumed to follow from a cage that fits the object closely enough; if those proxies do not track human perception, the advantage is unverified.

Editorial extensions

If this is right

  • A deformation-based attack can reach near-maximal attack success while scoring lower on five geometric naturalness metrics than nine baseline methods, including other deformation attacks.
  • CageAttack maintains competitive transferability across model pairs, with success rates up to roughly 85 percent in some settings, while preserving much higher perceptual quality than the most transferable baselines.
  • Against the strong IF-Defense defense, CageAttack keeps attack success above 25 percent across victim models, whereas most non-deformation attacks fall to well below that.
  • The method carries over to physical attacks: reconstructed, 3D-printed, and re-scanned adversarial objects still fool the victim model on some samples.
  • Cage subdivision and vertex optimization are necessary components: ablations show skipping either one degrades naturalness metrics and attack success.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the naturalness metrics are trusted, the cage idea could transfer to other geometry-processing tasks, such as adversarial attacks on meshes or implicit surfaces, where a structured deformation handle is equally available.
  • Because the cage provides a low-dimensional control space, CageAttack could serve as a probe for studying the geometry of adversarial directions in shape space, where each perturbation corresponds to a coherent geometric change rather than independent point motion.
  • A testable extension would be to analyze how cage fitting error—especially for concave or complex objects—affects the smoothness guarantee; the paper does not provide such analysis, and the method's reliance on an enclosing sphere suggests this is the key boundary condition.
  • One could check whether the transferability gain comes from the cage's smoothness or simply from larger overall deformation magnitude, by matching displacement magnitudes across attacks; the paper does not isolate this.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces CageAttack, a deformation-based adversarial attack for 3D point clouds. A cage enclosing the input cloud is constructed via curvature- and density-aware subdivision and vertex optimization; the attacker then perturbs cage vertices, and mean value coordinates propagate the deformation to the cloud. The attack is evaluated on ModelNet40, ScanObjectNN, and ShapeNet Part against six (abstract says seven) classifiers, with comparisons to nine baselines on attack success, transferability, robustness to four defenses, and five geometric naturalness metrics, plus ablations, a 10-participant user study, and a physical 3D-printing experiment. The central claim is that CageAttack achieves a superior balance of transferability, undefendability, and plausibility.

Significance. The proposed use of a cage as a structured deformation handle is a novel and sensible idea for point-cloud attacks; if the plausibility claim holds, the method is a useful contribution. The paper's experimental breadth is a strength: three datasets, multiple architectures, nine baselines, four defenses, ablations of the cage-construction stages, and a physical attack attempt. The code-release statement and the ablation study (Tab. IV) are also positive. However, the plausibility leg of the central claim is currently under-supported, and several load-bearing claims need better evidence.

major comments (4)
  1. [§V.A, Tab. V] The five naturalness metrics (CSD, Curv, Uni, KNN, Lap) are not defined in the paper and are never validated against human judgments, yet the user study in Tab. V uses only 10 participants, does not include the original clean cloud as a baseline, and asks participants to pick the 'most plausible' among five attack outputs. This design at best shows relative plausibility among a flawed set and cannot establish the absolute claim that CageAttack deformations are natural. I ask the authors to include the original cloud as a control, report pairwise preference counts and inter-rater agreement, and provide a per-sample correlation between the geometric metrics and human ratings.
  2. [§V.C] The physical attack experiment is reported only as 'some samples successfully fool the model,' with no success rate, sample size, or quantitative comparison before/after 3D printing and re-scanning. Because the physical-domain claim is part of the paper's motivation, this section should report the number of trials, the attack success rate, and ideally per-sample geometric deviation introduced by fabrication.
  3. [§IV.A, Eq. (8)] The cage construction and vertex optimization do not enforce that the cage remains non-self-intersecting or that all points stay inside the cage; mean value coordinates (Eq. 4) are well-defined for closed cages but can be negative for exterior points, and Eq. (6) assumes the coordinates remain valid. The paper provides no failure analysis or statistics on how often the optimization produces a degenerate cage for the 1,024-point inputs. Please add explicit constraints or report the incidence of invalid/degenerate cages and how such cases are handled.
  4. [Tabs. I–III] All reported ASR and naturalness values are point estimates without error bars, number of repetitions, or significance tests. Several differences between CageAttack and the closest baselines are small (for example, the DGCNN ShapeNet Part Curv values tie at 6.920 in Tab. I), so the 'superior balance' conclusion needs variance information or a statistical comparison to be robust.
minor comments (6)
  1. [Abstract vs. V.A] The abstract states that experiments cover 'seven 3D deep neural network classifiers,' but Section V.A lists six (PointNet, PointNet++, DGCNN, PointMLP, PCT, Mamba3D); please correct this inconsistency.
  2. [§V.A] The five naturalness metrics are called 'widely recognized' but are not defined; Curv has no citation, and CSD, Uni, KNN, and Lap only have references. Please give definitions or precise formulas so the reader can interpret the magnitudes in Tab. I.
  3. [Eq. (7)] The subdivision criterion uses Scur and Sden, but the paper only describes them verbally as 'average curvature' and 'density' of points in a tetrahedron; specify how these are computed and normalized.
  4. [Fig. 3] The trade-off plots show 'ASR vs. KNN,' but the axes, the plotted curves, and how the Pareto frontier is determined are not explained; please add labels and a caption that defines the metric on the y-axis.
  5. [Fig. 1 caption] The phrase 'remain hidden in the human psyche' is informal and unclear; rephrase to describe human perceptibility.
  6. [Tab. V] The user study description does not state whether each participant rated all 100 samples, what instructions were given, or how ties were handled; please provide the protocol and inter-rater agreement.

Circularity Check

1 steps flagged · score 6.0 of 10

Partial circularity: the Laplacian naturalness metric is minimized in the cage-construction objective (Eq. 8) and then reported as an independent plausibility advantage.

  1. fitted input called prediction [Sec. IV.A Eq. (8); Sec. V.A evaluation metrics and Tab. I]
    "we further refine the positions of the cage vertices. Specifically, we optimize the following objective: min_C sum_{pi∈P} Dist(pi,C) + λa Var_area(T) + λl Lap(C), (8) ... Lap(C) is a regularization term that enforces face smoothing [37]. ... we evaluate the naturalness of the attacks using five widely recognized metrics: ... Laplacian loss (Lap) [37]."

    The cage-construction objective (Eq. 8) explicitly minimizes the Laplacian loss Lap(C) with weight λl = 100.0, the largest weight in the objective, and the naturalness evaluation uses 'Laplacian loss (Lap) [37]' as one of its five metrics, citing the same source [37] for both. Because each deformed point is an affine combination of cage vertices (Eq. 6), a cage fitted to be smooth produces a point cloud with low Lap essentially by construction. The Lap column in Tab. I is therefore not an independent empirical prediction; it is a read-out of the fitted smoothness regularizer. The remaining four metrics are not directly in Eq. 8, and attack success, transferability, and undefendability are evaluated externally, so the circularity is partial rather than total.

full rationale

The central claim of a 'superior balance' has substantial independent content: transferability (Tab. II) and undefendability (Tab. III) are measured against external baselines and are not determined by the cage-fitting objective. The user study and visualizations also provide perceptual evidence that is not a byproduct of the reported numeric losses. However, one of the five naturalness metrics used to support the plausibility leg, Laplacian loss, is the same loss minimized in Eq. (8) with the largest weight (λl = 100.0), and both uses cite the same source [37]. Reporting a low Lap value for CageAttack is therefore partially a consequence of optimizing that metric during cage construction, not an emergent discovery. This is a specific, quotable reduction of one 'prediction' to its own fitting objective. Since the other four metrics, the attack-success metrics, and the transferability/undefendability comparisons are not fitted in this way, the paper is not wholly circular; the circularity is confined to the Laplacian-based naturalness advantage.

Assumptions & free parameters 6 free parameters · 3 assumptions · 0 invented entities

No fundamentally new entity is introduced; the cage is a tool from geometric modeling. The main burden is the set of hand-tuned hyperparameters and the unproven premise that cage-space perturbations preserve perceptual naturalness.

free parameters (6)
  • lambda_d = 0.25
    Weight balancing curvature and density in subdivision score S(e_i) (Eq. 7); chosen via ablation on PointNet/ModelNet40 in Section V-C.
  • subdivision_threshold_tau = top 1/5 tetrahedra
    Threshold so the top one-fifth of tetrahedra are subdivided; tuned in Section V-C.
  • lambda_a = 10.0
    Weights area variance in vertex optimization (Eq. 8); tuned in Section V-C.
  • lambda_l = 100.0
    Weights Laplacian smoothing in vertex optimization (Eq. 8); set in Section V-A.
  • lambda_1 = 1.0
    Weight of distance metric in attack objective (Eq. 9); set in Section V-A.
  • num_optimization_iterations = 2000
    Iterations for cage vertex optimization; convergence after 2000 per Section V-C.
assumptions (3)
  • standard math Mean value coordinates define a linear map from cage vertices to interior points (Eqs. 4-6).
    Adopted from Ju et al. [64], requiring a closed cage; this is an established result.
  • domain assumption The cage remains closed and surrounds the point cloud after subdivision and vertex optimization.
    The method initializes a unit sphere and refines it; the paper gives no proof that the optimized cage still encapsulates the object or that MVC weights stay non-negative.
  • ad hoc to paper Perturbing cage vertices yields globally smooth deformations that preserve object naturalness.
    This is the central premise the paper tests empirically; it is not derived and is only supported by the chosen naturalness metrics.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Cage-Based Deformation for Transferable and Undefendable Point Cloud Attack." pith.science (2026). https://pith.science/paper/4CCCTVQQ

@misc{pith2026250700690,
  author       = {Pith},
  title        = {Pith review of: Cage-Based Deformation for Transferable and Undefendable Point Cloud Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4CCCTVQQ}},
  note         = {Machine review of arXiv:2507.00690}
}
read the original abstract

Adversarial attacks on point clouds often impose strict geometric constraints to preserve plausibility; however, such constraints inherently limit transferability and undefendability. While deformation offers an alternative, existing unstructured approaches may introduce unnatural distortions, making adversarial point clouds conspicuous and undermining their plausibility. In this paper, we propose CageAttack, a cage-based deformation framework that produces natural adversarial point clouds. It first constructs a cage around the target object, providing a structured basis for smooth, natural-looking deformation. Perturbations are then applied to the cage vertices, which seamlessly propagate to the point cloud, ensuring that the resulting deformations remain intrinsic to the object and preserve plausibility. Extensive experiments on seven 3D deep neural network classifiers across three datasets show that CageAttack achieves a superior balance among transferability, undefendability, and plausibility, outperforming state-of-the-art methods. Codes will be made public upon acceptance.

Figures

Figures reproduced from arXiv: 2507.00690 by the authors.

Figure 1
Figure 1. Given a point cloud, adversarial attacks achieve plausibility by [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of our CageAttack framework. Given an input point cloud, a surrounding cage is first constructed, followed by subdivision and vertex [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Top row: Trade-off between transferability (measured by ASR) and naturalness (measured by KNN) for various attack methods on ModelNet40. Bottom row: Trade-off between undefendability (measured by ASR) and naturalness (measured by KNN) for different attack methods on ModelNet40 [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Visualizations of original and adversarial point clouds generated to fool PointNet on ModelNet40 by various adversarial attack methods. The ground [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Visualizations of (a) original point clouds, (b) initially constructed cages, (c) cages after curvature- and density-aware subdivision, and (d) cages after [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Physical attack targeting PointNet on ModelNet40: (a) Generated [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Evaluation of the naturalness performance of CageAttack in attacking PointNet trained on the ModelNet40 dataset. The performance is measured [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

69 extracted references · 60 canonical work pages

  1. [1]

    Deep learning for 3d point clouds: A survey,

    Y . Guo, H. Wang, Q. Hu, H. Liu, L. Liu, and M. Bennamoun, “Deep learning for 3d point clouds: A survey,” TPAMI, vol. 43, no. 12, pp. 4338–4364, 2020

    work page 2020

  2. [2]

    Mamba3d: Enhancing local features for 3d point cloud analysis via state space model,

    X. Han, Y . Tang, Z. Wang, and X. Li, “Mamba3d: Enhancing local features for 3d point cloud analysis via state space model,” in ACM MM, 2024, pp. 4995–5004

    work page 2024

  3. [3]

    Generating 3d adversarial point clouds,

    C. Xiang, C. R. Qi, and B. Li, “Generating 3d adversarial point clouds,” in CVPR, 2019, pp. 9136–9144

    work page 2019

  4. [4]

    Extending adversarial attacks and defenses to deep 3d point cloud classifiers,

    D. Liu, R. Yu, and H. Su, “Extending adversarial attacks and defenses to deep 3d point cloud classifiers,” in ICIP, 2019, pp. 2279–2283. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 10

    work page 2019

  5. [5]

    Recent advances in adversarial training for adversarial robustness,

    T. Bai, J. Luo, J. Zhao, B. Wen, and Q. Wang, “Recent advances in adversarial training for adversarial robustness,” in IJCAI, 2021, pp. 4312–4321

    work page 2021

  6. [6]

    Imperceptible transfer attack and defense on 3d point cloud classification,

    D. Liu and W. Hu, “Imperceptible transfer attack and defense on 3d point cloud classification,” TPAMI, vol. 45, no. 4, pp. 4727–4746, 2023

    work page 2023

  7. [7]

    Advpc: Transferable adversarial perturbations on 3d point clouds,

    A. Hamdi, S. Rojas, A. Thabet, and B. Ghanem, “Advpc: Transferable adversarial perturbations on 3d point clouds,” in ECCV, 2020, pp. 241– 257

    work page 2020

  8. [8]

    Generating transferable 3d adversarial point cloud via random perturbation factor- ization,

    B. He, J. Liu, Y . Li, S. Liang, J. Li, X. Jia, and X. Cao, “Generating transferable 3d adversarial point cloud via random perturbation factor- ization,” in AAAI, vol. 37, no. 1, 2023, pp. 764–772

    work page 2023

Show all 69 references
  1. [9]

    Anf: Crafting transferable adversarial point clouds via adversarial noise factorization,

    H. Chen, S. Zhao, X. Yang, H. Yan, Y . He, H. Xue, F. Qian, and H. Su, “Anf: Crafting transferable adversarial point clouds via adversarial noise factorization,” TBD, 2024

    2024

  2. [10]

    Deep manifold attack on point clouds via parameter plane stretching,

    K. Tang, J. Wu, W. Peng, Y . Shi, P. Song, Z. Gu, Z. Tian, and W. Wang, “Deep manifold attack on point clouds via parameter plane stretching,” in AAAI, vol. 37, no. 2, 2023, pp. 2420–2428

    2023

  3. [11]

    Hide in thicket: Generating imperceptible and rational adversarial perturbations on 3d point clouds,

    T. Lou, X. Jia, J. Gu, L. Liu, S. Liang, B. He, and X. Cao, “Hide in thicket: Generating imperceptible and rational adversarial perturbations on 3d point clouds,” in CVPR, 2024, pp. 24 326–24 335

    2024

  4. [12]

    Pointnet: Deep learning on point sets for 3d classification and segmentation,

    C. R. Qi, H. Su, K. Mo, and L. J. Guibas, “Pointnet: Deep learning on point sets for 3d classification and segmentation,” in CVPR, 2017, pp. 652–660

    2017

  5. [13]

    3d shapenets: A deep representation for volumetric shapes,

    Z. Wu, S. Song, A. Khosla, F. Yu, L. Zhang, X. Tang, and J. Xiao, “3d shapenets: A deep representation for volumetric shapes,” in CVPR, 2015, pp. 1912–1920

    2015

  6. [14]

    Shapenet: An information- rich 3d model repository,

    A. X. Chang, T. Funkhouser, L. Guibas, P. Hanrahan, Q. Huang, Z. Li, S. Savarese, M. Savva, S. Song, H. Su et al., “Shapenet: An information- rich 3d model repository,” arXiv preprint arXiv:1512.03012 , 2015

    2015 arXiv

  7. [15]

    Revisiting point cloud classification: A new benchmark dataset and classification model on real-world data,

    M. A. Uy, Q.-H. Pham, B.-S. Hua, D. T. Nguyen, and S.-K. Yeung, “Revisiting point cloud classification: A new benchmark dataset and classification model on real-world data,” in ICCV, 2019

    2019

  8. [16]

    A survey on adversarial attacks and defences,

    A. Chakraborty, M. Alam, V . Dey, A. Chattopadhyay, and D. Mukhopad- hyay, “A survey on adversarial attacks and defences,”CAAI Transactions on Intelligence Technology, vol. 6, no. 1, pp. 25–45, 2021

    2021

  9. [17]

    Adversarial attacks and defenses in deep learning,

    K. Ren, T. Zheng, Z. Qin, and X. Liu, “Adversarial attacks and defenses in deep learning,” Engineering, vol. 6, no. 3, pp. 346–360, 2020

    2020

  10. [18]

    Physical adversarial attack meets computer vision: A decade survey,

    H. Wei, H. Tang, X. Jia, Z. Wang, H. Yu, Z. Li, S. Satoh, L. Van Gool, and Z. Wang, “Physical adversarial attack meets computer vision: A decade survey,” TPAMI, 2024

    2024

  11. [19]

    Pointcloud saliency maps,

    T. Zheng, C. Chen, J. Yuan, B. Li, and K. Ren, “Pointcloud saliency maps,” in ICCV, 2019, pp. 1598–1606

    2019

  12. [20]

    Adversarial attack and defense on point sets,

    J. Yang, Q. Zhang, R. Fang, B. Ni, J. Liu, and Q. Tian, “Adversarial attack and defense on point sets,” arXiv preprint arXiv:1902.10899 , 2019

    1902 arXiv

  13. [21]

    Robustness of 3d deep learning in an adversarial setting,

    M. Wicker and M. Kwiatkowska, “Robustness of 3d deep learning in an adversarial setting,” in CVPR, 2019, pp. 11 767–11 775

    2019

  14. [22]

    Td-net: Topology destruction network for generating adversarial point cloud,

    J. Zhang, C. Jiang, X. Wang, and M. Cai, “Td-net: Topology destruction network for generating adversarial point cloud,” inICIP, 2021, pp. 3098– 3102

    2021

  15. [23]

    On isometry robustness of deep 3d point cloud models under adversarial attacks,

    Y . Zhao, Y . Wu, C. Chen, and A. Lim, “On isometry robustness of deep 3d point cloud models under adversarial attacks,” in CVPR, 2020, pp. 1201–1210

    2020

  16. [24]

    Minimal adversarial examples for deep learning on 3d point clouds,

    J. Kim, B.-S. Hua, T. Nguyen, and S.-K. Yeung, “Minimal adversarial examples for deep learning on 3d point clouds,” in ICCV, 2021, pp. 7797–7806

    2021

  17. [25]

    Hiding imperceptible noise in curvature-aware patches for 3d point cloud attack,

    M. Yang, D. Liu, K. Tang, P. Zhou, L. Chen, and J. Chen, “Hiding imperceptible noise in curvature-aware patches for 3d point cloud attack,” in ECCV, 2024, pp. 431–448

    2024

  18. [26]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in S&P, 2017, pp. 39–57

    2017

  19. [27]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in ICLR, 2015

    2015

  20. [28]

    Geometry-aware generation of adversarial point clouds,

    Y . Wen, J. Lin, K. Chen, C. P. Chen, and K. Jia, “Geometry-aware generation of adversarial point clouds,” IEEE TPAMI, vol. 44, no. 6, pp. 2984–2999, 2022

    2022

  21. [29]

    Shape- invariant 3d adversarial point clouds,

    Q. Huang, X. Dong, D. Chen, H. Zhou, W. Zhang, and N. Yu, “Shape- invariant 3d adversarial point clouds,” in CVPR, 2022, pp. 15 335– 15 344

    2022

  22. [30]

    Rethinking perturbation directions for imperceptible adversarial attacks on point clouds,

    K. Tang, Y . Shi, T. Lou, W. Peng, X. He, P. Zhu, Z. Gu, and Z. Tian, “Rethinking perturbation directions for imperceptible adversarial attacks on point clouds,” IEEE Internet of Things Journal , vol. 10, no. 6, pp. 5158–5169, 2023

    2023

  23. [31]

    Manifold constraints for imperceptible adversarial attacks on point clouds,

    K. Tang, X. He, W. Peng, J. Wu, Y . Shi, D. Liu, P. Zhou, W. Wang, and Z. Tian, “Manifold constraints for imperceptible adversarial attacks on point clouds,” in AAAI, vol. 38, no. 6, 2024, pp. 5127–5135

    2024

  24. [32]

    Flat: Flux-aware imperceptible adversarial attacks on 3d point clouds,

    K. Tang, L. Huang, W. Peng, D. Liu, X. Wang, Y . Ma, L. Liu, and Z. Tian, “Flat: Flux-aware imperceptible adversarial attacks on 3d point clouds,” in ECCV. Springer, 2024, pp. 198–215

    2024

  25. [33]

    Symattack: Symmetry-aware imperceptible adversarial attacks on 3d point clouds,

    K. Tang, Z. Wang, W. Peng, L. Huang, L. Wang, P. Zhu, W. Wang, and Z. Tian, “Symattack: Symmetry-aware imperceptible adversarial attacks on 3d point clouds,” in MM, 2024, pp. 3131–3140

    2024

  26. [34]

    Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep networks,

    H. Zhou, D. Chen, J. Liao, K. Chen, X. Dong, K. Liu, W. Zhang, G. Hua, and N. Yu, “Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep networks,” in CVPR, 2020, pp. 10 356–10 365

    2020

  27. [35]

    Shapeadv: Generating shape-aware adversarial 3d point clouds,

    K. Lee, Z. Chen, X. Yan, R. Urtasun, and E. Yumer, “Shapeadv: Generating shape-aware adversarial 3d point clouds,” arXiv preprint arXiv:2005.11626, 2020

    2005 arXiv

  28. [36]

    Robust adversarial objects against deep learning models,

    T. Tsai, K. Yang, T.-Y . Ho, and Y . Jin, “Robust adversarial objects against deep learning models,” in AAAI, vol. 34, no. 01, 2020, pp. 954– 962

    2020

  29. [37]

    3d adversarial attacks beyond point cloud,

    J. Zhang, L. Chen, B. Liu, B. Ouyang, Q. Xie, J. Zhu, W. Li, and Y . Meng, “3d adversarial attacks beyond point cloud,” Information Sciences, vol. 633, pp. 491–503, 2023

    2023

  30. [38]

    Isometric 3d adversarial examples in the physical world,

    Y . Dong, J. Zhu, X.-S. Gao et al. , “Isometric 3d adversarial examples in the physical world,” in NeurIPS, vol. 35, 2022, pp. 19 716–19 731

    2022

  31. [39]

    V oxnet: A 3d convolutional neural network for real-time object recognition,

    D. Maturana and S. Scherer, “V oxnet: A 3d convolutional neural network for real-time object recognition,” in IROS, 2015, pp. 922–928

    2015

  32. [40]

    Pointnet++ deep hierarchical feature learning on point sets in a metric space,

    C. R. Qi, L. Yi, H. Su, and L. J. Guibas, “Pointnet++ deep hierarchical feature learning on point sets in a metric space,” in NeurIPS, 2017, pp. 5105–5114

    2017

  33. [41]

    Rethinking network design and local geometry in point cloud: A simple residual mlp framework,

    X. Ma, C. Qin, H. You, H. Ran, and Y . Fu, “Rethinking network design and local geometry in point cloud: A simple residual mlp framework,” in ICLR, 2022

    2022

  34. [42]

    Pointconv: Deep convolutional networks on 3d point clouds,

    W. Wu, Z. Qi, and L. Fuxin, “Pointconv: Deep convolutional networks on 3d point clouds,” in CVPR, 2019, pp. 9621–9630

    2019

  35. [43]

    Kpconv: Flexible and deformable convolution for point clouds,

    H. Thomas, C. R. Qi, J.-E. Deschaud, B. Marcotegui, F. Goulette, and L. J. Guibas, “Kpconv: Flexible and deformable convolution for point clouds,” in ICCV, 2019, pp. 6411–6420

    2019

  36. [44]

    Paconv: Position adaptive convolution with dynamic kernel assembling on point clouds,

    M. Xu, R. Ding, H. Zhao, and X. Qi, “Paconv: Position adaptive convolution with dynamic kernel assembling on point clouds,” CVPR, 2021

    2021

  37. [45]

    Pointcnn: Convolution on χ-transformed points,

    Y . Li, R. Bu, M. Sun, W. Wu, X. Di, and B. Chen, “Pointcnn: Convolution on χ-transformed points,” in NeurIPS, 2018, pp. 820–830

    2018

  38. [46]

    Dynamic graph cnn for learning on point clouds,

    Y . Wang, Y . Sun, Z. Liu, S. E. Sarma, M. M. Bronstein, and J. M. Solomon, “Dynamic graph cnn for learning on point clouds,” TOG, vol. 38, no. 5, pp. 1–12, 2019

    2019

  39. [47]

    Pointweb: Enhancing local neighborhood features for point cloud processing,

    H. Zhao, L. Jiang, C.-W. Fu, and J. Jia, “Pointweb: Enhancing local neighborhood features for point cloud processing,” in CVPR, 2019, pp. 5565–5573

    2019

  40. [48]

    Point-gnn: Graph neural network for 3d object detection in a point cloud,

    W. Shi and R. Rajkumar, “Point-gnn: Graph neural network for 3d object detection in a point cloud,” in CVPR, 2020, pp. 1711–1719

    2020

  41. [49]

    Ddgcn: graph convolution network based on direction and distance for point cloud learning,

    L. Chen and Q. Zhang, “Ddgcn: graph convolution network based on direction and distance for point cloud learning,” The Visual Computer , vol. 39, no. 3, pp. 863–873, 2023

    2023

  42. [51]

    Pct: Point cloud transformer,

    M.-H. Guo, J.-X. Cai, Z.-N. Liu, T.-J. Mu, R. R. Martin, and S.-M. Hu, “Pct: Point cloud transformer,” Computational Visual Media, vol. 7, pp. 187–199, 2021

    2021

  43. [52]

    Point transformer v2: Grouped vector attention and partition-based pooling,

    X. Wu, Y . Lao, L. Jiang, X. Liu, and H. Zhao, “Point transformer v2: Grouped vector attention and partition-based pooling,” in NeurIPS, vol. 35, 2022, pp. 33 330–33 342

    2022

  44. [53]

    Point transformer v3: Simpler faster stronger,

    X. Wu, L. Jiang, P.-S. Wang, Z. Liu, X. Liu, Y . Qiao, W. Ouyang, T. He, and H. Zhao, “Point transformer v3: Simpler faster stronger,” in CVPR, 2024, pp. 4840–4851

    2024

  45. [54]

    Pointmamba: A simple state space model for point cloud analysis,

    D. Liang, X. Zhou, W. Xu, X. Zhu, Z. Zou, X. Ye, X. Tan, and X. Bai, “Pointmamba: A simple state space model for point cloud analysis,” in NeurIPS, 2024

    2024

  46. [55]

    Deep learning advances in computer vision with 3d data: A survey,

    A. Ioannidou, E. Chatzilari, S. Nikolopoulos, and I. Kompatsiaris, “Deep learning advances in computer vision with 3d data: A survey,” ACM computing surveys (CSUR) , vol. 50, no. 2, pp. 1–38, 2017

    2017

  47. [56]

    Scape: Shape completion and animation of people,

    D. Anguelov, P. Srinivasan, D. Koller, S. Thrun, J. Rodgers, and J. Davis, “Scape: Shape completion and animation of people,”TOG, vol. 24, no. 3, pp. 408–416, 2005

    2005

  48. [57]

    Diffcloth: Differentiable cloth simulation with dry frictional contact,

    Y . Li, T. Du, K. Wu, J. Xu, and W. Matusik, “Diffcloth: Differentiable cloth simulation with dry frictional contact,” TOG, vol. 42, no. 1, pp. 1–20, 2022

    2022

  49. [58]

    Lattice-based skinning and deformation for real-time skeleton-driven animation,

    C.-H. Chen, I.-C. Lin, M.-H. Tsai, and P.-H. Lu, “Lattice-based skinning and deformation for real-time skeleton-driven animation,” in Interna- tional Conference on Computer-Aided Design and Computer Graphics , 2011, pp. 306–312. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AU...

    2011

  50. [59]

    Inter- active skeleton-driven dynamic deformations,

    S. Capell, S. Green, B. Curless, T. Duchamp, and Z. Popovi ´c, “Inter- active skeleton-driven dynamic deformations,” TOG, vol. 21, no. 3, pp. 586–593, 2002

    2002

  51. [60]

    Skeleton-based variational mesh deformations,

    S. Yoshizawa, A. Belyaev, and H.-P. Seidel, “Skeleton-based variational mesh deformations,” Computer Graphics Forum, vol. 26, no. 3, pp. 255– 264, 2007

    2007

  52. [61]

    Cage based deformations: a survey,

    J. R. Nieto and A. Sus ´ın, “Cage based deformations: a survey,” in Deformation Models: Tracking, Animation and Applications . Springer, 2012, pp. 75–99

    2012

  53. [62]

    Cages: a multilevel, multi-cage-based system for mesh deformation,

    F. G. Garc ´ıa, T. Paradinas, N. Coll, and G. Patow, “Cages: a multilevel, multi-cage-based system for mesh deformation,” TOG, vol. 32, no. 3, pp. 1–13, 2013

    2013

  54. [63]

    A survey on cage-based deformation of 3d models,

    D. Str ¨oter, J. Thiery, K. Hormann, J. Chen, Q. Chang, S. Besler, J. Mueller-Roemer, T. Boubekeur, A. Stork, and D. Fellner, “A survey on cage-based deformation of 3d models,” Computer Graphics Forum, vol. 43, no. 2, 2024

    2024

  55. [64]

    Mean value coordinates for closed tri- angular meshes,

    T. Ju, S. Schaefer, and J. Warren, “Mean value coordinates for closed tri- angular meshes,” in Seminal Graphics Papers: Pushing the Boundaries, Volume 2, 2023, pp. 223–228

    2023

  56. [65]

    Pytorch: An imperative style, high- performance deep learning library,

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. K ¨opf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala, “Pytorch: An imperative style, high-...

    2019

  57. [66]

    Point transformer,

    H. Zhao, L. Jiang, J. Jia, P. H. Torr, and V . Koltun, “Point transformer,” in ICCV, 2021, pp. 16 259–16 268

    2021

  58. [67]

    Self-robust 3d point recognition via gather-vector guidance,

    X. Dong, D. Chen, H. Zhou, G. Hua, W. Zhang, and N. Yu, “Self-robust 3d point recognition via gather-vector guidance,” in CVPR, 2020, pp. 11 513–11 521

    2020

  59. [68]

    Dup- net: Denoiser and upsampler network for 3d adversarial point clouds defense,

    H. Zhou, K. Chen, W. Zhang, H. Fang, W. Zhou, and N. Yu, “Dup- net: Denoiser and upsampler network for 3d adversarial point clouds defense,” in ICCV, 2019, pp. 1961–1970

    2019

  60. [69]

    If-defense: 3d adversarial point cloud defense via implicit function based restoration,

    Z. Wu, Y . Duan, H. Wang, Q. Fan, and L. J. Guibas, “If-defense: 3d adversarial point cloud defense via implicit function based restoration,” arXiv preprint arXiv:2010.05272 , 2020

    2010 arXiv

  61. [70]

    Pu-gan: a point cloud upsampling adversarial network,

    R. Li, X. Li, C.-W. Fu, D. Cohen-Or, and P.-A. Heng, “Pu-gan: a point cloud upsampling adversarial network,” in ICCV, 2019, pp. 7203–7212

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.