arxiv: 2604.09879 · v1 · submitted 2026-04-10 · 💻 cs.CV · cs.CG

Recognition: unknown

Topo-ADV: Generating Topology-Driven Imperceptible Adversarial Point Clouds

Anirban Ghosh, Ayan Dutta, Gayathry Chandramana Krishnan Nampoothiry, Raghuram Venkatapuram

Authors on Pith no claims yet

Pith reviewed 2026-05-10 17:24 UTC · model grok-4.3

classification 💻 cs.CV cs.CG

keywords adversarial attackspoint cloud classificationpersistent homologytopology-driven perturbationsimperceptible adversarial examples3D deep learning

0 comments

The pith

Manipulating the topology of 3D point clouds via persistent homology generates adversarial examples that fool classifiers while appearing geometrically identical.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper sets out to demonstrate that the homological structure of a 3D object offers an exploitable vulnerability for adversarial attacks on point cloud classifiers. It does so by building an end-to-end differentiable framework that treats persistent homology as an explicit optimization target rather than relying solely on changes to point locations or surface geometry. If the approach holds, semantic content can be disrupted without producing visible geometric distortion, which would undermine the common assumption that geometric fidelity alone preserves meaning in 3D data. This matters for any application that uses point cloud models in safety-critical settings where imperceptible changes could produce unexpected failures.

Core claim

Topo-ADV is an end-to-end differentiable framework that incorporates persistent homology as an explicit optimization objective, enabling gradient-based manipulation of topological features during adversarial example generation. By embedding persistence diagrams through differentiable topological representations, the method jointly optimizes a topology divergence loss that alters persistence, a misclassification objective, and geometric imperceptibility constraints that preserve visual plausibility.

What carries the argument

Differentiable persistence diagrams, which embed topological features so that a topology divergence loss can be optimized together with classification and geometric terms.

If this is right

Subtle topology-driven perturbations achieve up to 100 percent attack success on ModelNet40, ShapeNet Part, and ScanObjectNN using PointNet and DGCNN.
The resulting point clouds remain geometrically indistinguishable from the originals and outperform prior methods on perceptibility metrics.
Jointly optimizing topology divergence, misclassification, and geometric constraints produces stronger imperceptible attacks than geometry-only baselines.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Robustness evaluations for 3D models may need to include topological invariants in addition to geometric checks.
The same differentiable persistence technique could be applied to other structured data such as meshes or graphs to probe similar vulnerabilities.
Training procedures that regularize topological features might improve resistance to this class of attack.

Load-bearing premise

That changes made to homological features through persistence diagrams remain compatible with strict geometric imperceptibility constraints.

What would settle it

Generate the same adversarial examples both with and without the topology divergence loss term, then measure whether attack success rate drops sharply while geometric distance metrics stay comparable.

Figures

Figures reproduced from arXiv: 2604.09879 by Anirban Ghosh, Ayan Dutta, Gayathry Chandramana Krishnan Nampoothiry, Raghuram Venkatapuram.

**Figure 1.** Figure 1: An airplane point cloud from ModelNet40 and its adversarial counterpart generated by Topo-ADV are shown alongside their corresponding persistence diagrams. The adversarial point cloud causes PointNet to misclassify the airplane as a piano. Note that the persistence diagram changed after we perturbed the original point cloud. intentionally modifies persistent homology, (ii) a misclassification loss that red… view at source ↗

**Figure 2.** Figure 2: Visualization of representative original and adversarial ShapeNet Part point clouds generated by Topo-ADV, [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

**Figure 3.** Figure 3: Visualization of representative original and adversarial ScanObjectNN point clouds generated by Topo-ADV, [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗

**Figure 4.** Figure 4: Visualization of representative original and adversarial ModelNet40 point clouds generated by Topo-ADV, [PITH_FULL_IMAGE:figures/full_fig_p015_4.png] view at source ↗

read the original abstract

Deep neural networks for 3D point cloud understanding have achieved remarkable success in object classification and recognition, yet recent work shows that these models remain highly vulnerable to adversarial perturbations. Existing 3D attacks predominantly manipulate geometric properties such as point locations, curvature, or surface structure, implicitly assuming that preserving global shape fidelity preserves semantic content. In this work, we challenge this assumption and introduce the first topology-driven adversarial attack for point cloud deep learning. Our key insight is that the homological structure of a 3D object constitutes a previously unexplored vulnerability surface. We propose Topo-ADV, an end-to-end differentiable framework that incorporates persistent homology as an explicit optimization objective, enabling gradient-based manipulation of topological features during adversarial example generation. By embedding persistence diagrams through differentiable topological representations, our method jointly optimizes (i) a topology divergence loss that alters persistence, (ii) a misclassification objective, and (iii) geometric imperceptibility constraints that preserve visual plausibility. Experiments demonstrate that subtle topology-driven perturbations consistently achieve up to 100% attack success rates on benchmark datasets such as ModelNet40, ShapeNet Part, and ScanObjectNN using PointNet and DGCNN classifiers, while remaining geometrically indistinguishable from the original point clouds, beating state-of-the-art methods on various perceptibility metrics.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

Topo-ADV claims to be the first persistent-homology attack on point clouds and reports near-100% success with good imperceptibility, but the abstract leaves the necessity of the topology term untested.

read the letter

The paper's core move is to treat the persistence diagram of a point cloud as an explicit target during adversarial optimization. They add a topology divergence loss alongside the usual misclassification and geometric terms, then back-propagate through a differentiable representation of the diagrams. That is the actual novelty: prior 3D attacks stayed inside geometric or curvature losses, while this one tries to change homological features directly. On the positive side, the framework is end-to-end differentiable and they evaluate on the usual benchmarks (ModelNet40, ShapeNet Part, ScanObjectNN) with PointNet and DGCNN, claiming up to 100% attack success while staying below standard perceptibility thresholds. Those numbers, if they hold with proper controls, would be useful to the subfield. The soft spots are exactly where the stress-test note points. The abstract gives no ablation that removes or replaces the topology term, no concrete implementation details on how persistence is made differentiable, and no error bars or exact baseline tables. Without those, it is impossible to tell whether the reported gains come from the homological objective or simply from adding another regularizer under geometric constraints. The claim that topology is a previously unexplored vulnerability surface therefore rests on an unverified assumption. This work is aimed at researchers already working on 3D adversarial robustness and topological data analysis. A reader who wants to see whether persistent homology actually buys anything new over standard point perturbations will get value from the full paper, but only after the missing controls are supplied. I would send it to peer review with a request for the ablations and implementation appendix; the idea is worth checking even if the current evidence is thin.

Referee Report

3 major / 2 minor

Summary. The manuscript introduces Topo-ADV, the first topology-driven adversarial attack for 3D point cloud classifiers. It embeds persistent homology via differentiable representations to jointly optimize a topology divergence loss (altering persistence diagrams), a misclassification objective, and geometric imperceptibility constraints, claiming that the resulting subtle perturbations achieve up to 100% attack success rates on ModelNet40, ShapeNet Part, and ScanObjectNN using PointNet and DGCNN while remaining geometrically indistinguishable and outperforming prior methods on perceptibility metrics.

Significance. If the central claim holds after verification, the work identifies homological structure as a previously unexploited vulnerability surface in 3D deep learning, moving beyond purely geometric perturbations. The explicit use of differentiable persistence diagrams is a technical contribution that could enable new lines of defense and clarify the role of topological invariants in semantic classification of point clouds.

major comments (3)

The central claim attributes high ASR and superior imperceptibility to explicit manipulation of homological structure. However, the manuscript provides no ablation studies that remove or replace the topology divergence loss with a generic regularizer while keeping the misclassification and geometric terms fixed. Without this comparison (e.g., in the Experiments section), it remains unclear whether the reported performance is load-bearing on the topology term or could be achieved by standard point perturbation under geometric constraints alone.
The abstract and method description claim an end-to-end differentiable framework via differentiable topological representations, yet no explicit derivation or pseudocode is given for how gradients flow through the persistence diagram computation and the topology divergence loss. This detail is load-bearing for the differentiability claim and must be supplied (e.g., in §3 or an appendix) to allow reproduction and verification.
Quantitative claims of beating SOTA on perceptibility metrics and achieving up to 100% ASR lack reported error bars, exact metric definitions, and full baseline tables. The Experiments section should include these to substantiate the superiority statements rather than relying on summary assertions.

minor comments (2)

The abstract refers to 'various perceptibility metrics' without naming them; the Experiments section should list the precise metrics (e.g., Chamfer distance, Hausdorff distance, or others) used for comparison.
Notation for the topology divergence loss and the embedding of persistence diagrams should be introduced with a clear equation in the Method section to improve readability.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive and detailed feedback on our manuscript. We have addressed each major comment point by point below and revised the manuscript to incorporate the requested clarifications and additions.

read point-by-point responses

Referee: The central claim attributes high ASR and superior imperceptibility to explicit manipulation of homological structure. However, the manuscript provides no ablation studies that remove or replace the topology divergence loss with a generic regularizer while keeping the misclassification and geometric terms fixed. Without this comparison (e.g., in the Experiments section), it remains unclear whether the reported performance is load-bearing on the topology term or could be achieved by standard point perturbation under geometric constraints alone.

Authors: We agree that an explicit ablation isolating the topology divergence loss is important to substantiate the central claim. In the revised manuscript, we have added a new ablation study in Section 4.3. This compares the full Topo-ADV objective against a variant that replaces the topology divergence loss with a standard geometric regularizer (e.g., point-wise L2 penalty) while retaining the misclassification and imperceptibility terms. The results confirm that the topology term is load-bearing: the ablated version exhibits substantially lower attack success rates or requires larger geometric perturbations to reach comparable ASR, supporting that homological manipulation provides a distinct advantage beyond generic regularization. revision: yes
Referee: The abstract and method description claim an end-to-end differentiable framework via differentiable topological representations, yet no explicit derivation or pseudocode is given for how gradients flow through the persistence diagram computation and the topology divergence loss. This detail is load-bearing for the differentiability claim and must be supplied (e.g., in §3 or an appendix) to allow reproduction and verification.

Authors: We acknowledge the need for explicit details on differentiability to support reproducibility. We have expanded Section 3.2 with a full derivation of the gradient flow: this includes the differentiable approximation of the Vietoris-Rips filtration, the computation of persistence diagrams via a soft sorting operation, and the backpropagation through the topology divergence loss (Wasserstein distance between diagrams). We have also added pseudocode in Appendix A that details both the forward pass for persistence computation and the backward pass for gradient computation with respect to the input point cloud. revision: yes
Referee: Quantitative claims of beating SOTA on perceptibility metrics and achieving up to 100% ASR lack reported error bars, exact metric definitions, and full baseline tables. The Experiments section should include these to substantiate the superiority statements rather than relying on summary assertions.

Authors: We have revised the Experiments section (now Section 4) to include all requested details. We now report error bars as standard deviations computed over five independent runs for all ASR and perceptibility metrics. Exact definitions are provided for each metric (e.g., Chamfer distance, Hausdorff distance, and the specific formulation of imperceptibility constraints). We have also expanded the tables to show complete numerical comparisons against all baselines on ModelNet40, ShapeNet Part, and ScanObjectNN for both PointNet and DGCNN, with per-class and aggregate results. revision: yes

Circularity Check

0 steps flagged

No circularity: novel topology divergence loss is independently defined and optimized

full rationale

The paper defines Topo-ADV as an end-to-end differentiable framework that explicitly introduces a new topology divergence loss based on persistent homology representations, jointly optimized with a misclassification objective and geometric imperceptibility constraints. No step reduces a claimed prediction or result to its own inputs by construction, fitted parameters, or self-citation chains; the homological manipulation is presented as a fresh optimization target rather than a renaming or tautological fit. Empirical results on ModelNet40, ShapeNet Part, and ScanObjectNN are reported as external validation, not forced by the method's definition.

Axiom & Free-Parameter Ledger

1 free parameters · 1 axioms · 0 invented entities

The central claim depends on the ability to embed persistence diagrams differentiably and on the assumption that topology changes can be optimized jointly with geometric constraints without side effects on perceptibility.

free parameters (1)

balancing weights for topology divergence, misclassification, and imperceptibility losses
Joint optimization of three objectives requires hand-chosen or tuned coefficients to achieve the reported trade-off between attack success and geometric fidelity.

axioms (1)

domain assumption Persistent homology admits a differentiable representation suitable for gradient-based optimization in point cloud space
The method relies on this to enable end-to-end training; invoked when embedding persistence diagrams.

pith-pipeline@v0.9.0 · 5549 in / 1222 out tokens · 52898 ms · 2026-05-10T17:24:30.516878+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

43 extracted references · 2 canonical work pages · 1 internal anchor

[1]

Adams, T

H. Adams, T. Emerson, M. Kirby, R. Neville, C. Peterson, P. Shipman, S. Chepushtanova, E. Hanson, F. Motta, and L. Ziegelmeier. Persistence images: A stable vector representation of persistent homology.Journal of Machine Learning Research, 18(8):1–35, 2017

2017
[2]

P. Bubenik. Statistical topological data analysis using persistence landscapes.The Journal of Machine Learning Research, 16(1):77–102, 2015

2015
[3]

Carlini and D

N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017

2017
[4]

Carrière, F

M. Carrière, F. Chazal, Y . Ike, T. Lacombe, M. Royer, and Y . Umeda. Perslay: A neural network layer for persistence diagrams and new graph topological signatures. InInternational Conference on Artificial Intelligence and Statistics, pages 2786–2796. PMLR, 2020

2020
[5]

Carriere, M

M. Carriere, M. Cuturi, and S. Oudot. Sliced wasserstein kernel for persistence diagrams. InInternational conference on machine learning, pages 664–673. PMLR, 2017

2017
[6]

A. X. Chang, T. Funkhouser, L. Guibas, P. Hanrahan, Q. Huang, Z. Li, S. Savarese, M. Savva, S. Song, H. Su, et al. Shapenet: An information-rich 3d model repository.arXiv preprint arXiv:1512.03012, 2015

work page internal anchor Pith review arXiv 2015
[7]

Chazal and B

F. Chazal and B. Michel. An introduction to topological data analysis: fundamental and practical aspects for data scientists.Frontiers in artificial intelligence, 4:667963, 2021

2021
[8]

C. Chen, X. Ni, Q. Bai, and Y . Wang. A topological regularizer for classifiers via persistent homology. InThe 22nd International Conference on Artificial Intelligence and Statistics, pages 2573–2582. PMLR, 2019

2019
[9]

De Berg, O

M. De Berg, O. Cheong, M. Van Kreveld, and M. Overmars.Computational geometry: algorithms and applications. Springer, 2008

2008
[10]

T. K. Dey and Y . Wang.Computational topology for data analysis. Cambridge University Press, 2022

2022
[11]

Y . Dong, J. Zhu, X.-S. Gao, et al. Isometric 3d adversarial examples in the physical world.Advances in Neural Information Processing Systems, 35:19716–19731, 2022

2022
[12]

Topological persistence and simplification.Discrete & computational geometry, 28(4):511–533, 2002

Edelsbrunner, Letscher, and Zomorodian. Topological persistence and simplification.Discrete & computational geometry, 28(4):511–533, 2002

2002
[13]

Edelsbrunner and J

H. Edelsbrunner and J. Harer.Computational topology: an introduction. American Mathematical Soc., 2010

2010
[14]

Guo, J.-X

M.-H. Guo, J.-X. Cai, Z.-N. Liu, T.-J. Mu, R. R. Martin, and S.-M. Hu. Pct: Point cloud transformer.Computational visual media, 7(2):187–199, 2021

2021
[15]

Hamdi, S

A. Hamdi, S. Rojas, A. Thabet, and B. Ghanem. Advpc: Transferable adversarial perturbations on 3d point clouds. InEuropean conference on computer vision, pages 241–257. Springer, 2020

2020
[16]

B. He, J. Liu, Y . Li, S. Liang, J. Li, X. Jia, and X. Cao. Generating transferable 3d adversarial point cloud via random perturbation factorization. InProceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 764–772, 2023

2023
[17]

Hofer, R

C. Hofer, R. Kwitt, M. Niethammer, and M. Dixit. Connectivity-optimized representation learning via persistent homology. InInternational conference on machine learning, pages 2751–2760. PMLR, 2019. 10 Topo-ADV: Generating Topology-Driven Imperceptible Adversarial Point CloudsA PREPRINT

2019
[18]

Hofer, R

C. Hofer, R. Kwitt, M. Niethammer, and A. Uhl. Deep learning with topological signatures.Advances in neural information processing systems, 30, 2017

2017
[19]

X. Hu, F. Li, D. Samaras, and C. Chen. Topology-preserving deep image segmentation.Advances in neural information processing systems, 32, 2019

2019
[20]

Huang, X

Q. Huang, X. Dong, D. Chen, H. Zhou, W. Zhang, and N. Yu. Shape-invariant 3d adversarial point clouds. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 15335–15344, 2022

2022
[21]

R. Li, X. Li, C.-W. Fu, D. Cohen-Or, and P.-A. Heng. Pu-gan: a point cloud upsampling adversarial network. In Proceedings of the IEEE/CVF international conference on computer vision, pages 7203–7212, 2019

2019
[22]

B. Liu, J. Zhang, and J. Zhu. Boosting 3d adversarial attacks with attacking on frequency.IEEE Access, 10:50974–50984, 2022

2022
[23]

D. Liu, R. Yu, and H. Su. Extending adversarial attacks and defenses to deep 3d point cloud classifiers. In2019 IEEE International Conference on Image Processing (ICIP), pages 2279–2283. IEEE, 2019

2019
[24]

T. Lou, X. Jia, J. Gu, L. Liu, S. Liang, B. He, and X. Cao. Hide in thicket: Generating imperceptible and rational adversarial perturbations on 3d point clouds. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24326–24335, 2024

2024
[25]

S. Pang, Z. Chen, S. Zhang, L. Lu, S. Liang, A. Du, and Y . Zhou. Towards a 3d transfer-based black-box attack via critical feature guidance. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 26912–26922, 2025

2025
[26]

C. R. Qi, H. Su, K. Mo, and L. J. Guibas. Pointnet: Deep learning on point sets for 3d classification and segmentation. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 652–660, 2017

2017
[27]

C. R. Qi, L. Yi, H. Su, and L. J. Guibas. Pointnet++: Deep hierarchical feature learning on point sets in a metric space.Advances in neural information processing systems, 30, 2017

2017
[28]

Rabadan and A

R. Rabadan and A. J. Blumberg.Topological data analysis for genomics and evolution: topology in biology. Cambridge University Press, 2019

2019
[29]

Rucco, F

M. Rucco, F. Castiglione, E. Merelli, and M. Pettini. Characterisation of the idiotypic immune network through persistent entropy. InProceedings of ECCS 2014: European conference on complex systems, pages 117–128. Springer, 2016

2014
[30]

J. Sun, K. Koenig, Y . Cao, Q. A. Chen, and Z. M. Mao. On adversarial robustness of 3d point cloud classification under adaptive attacks.arXiv preprint arXiv:2011.11922, 2020

work page arXiv 2011
[31]

L. Tang, Y . Zhan, Z. Chen, B. Yu, and D. Tao. Contrastive boundary learning for point cloud segmentation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8489–8499, 2022

2022
[32]

Thomas, C

H. Thomas, C. R. Qi, J.-E. Deschaud, B. Marcotegui, F. Goulette, and L. J. Guibas. Kpconv: Flexible and deformable convolution for point clouds. InProceedings of the IEEE/CVF international conference on computer vision, pages 6411–6420, 2019

2019
[33]

T. Tsai, K. Yang, T.-Y . Ho, and Y . Jin. Robust adversarial objects against deep learning models. InProceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 954–962, 2020

2020
[34]

M. A. Uy, Q.-H. Pham, B.-S. Hua, T. Nguyen, and S.-K. Yeung. Revisiting point cloud classification: A new benchmark dataset and classification model on real-world data. InProceedings of the IEEE/CVF international conference on computer vision, pages 1588–1597, 2019

2019
[35]

Y . Wang, Y . Sun, Z. Liu, S. E. Sarma, M. M. Bronstein, and J. M. Solomon. Dynamic graph cnn for learning on point clouds.ACM Transactions on Graphics (tog), 38(5):1–12, 2019

2019
[36]

Y . Wen, J. Lin, K. Chen, C. P. Chen, and K. Jia. Geometry-aware generation of adversarial point clouds.IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(6):2984–2999, 2020

2020
[37]

Z. Wu, S. Song, A. Khosla, F. Yu, L. Zhang, X. Tang, and J. Xiao. 3d shapenets: A deep representation for volumetric shapes. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 1912–1920, 2015

1912
[38]

Xiang, C

C. Xiang, C. R. Qi, and B. Li. Generating 3d adversarial point clouds. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9136–9144, 2019

2019
[39]

Zhang, L

J. Zhang, L. Chen, B. Liu, B. Ouyang, Q. Xie, J. Zhu, W. Li, and Y . Meng. 3d adversarial attacks beyond point cloud.Information Sciences, 633:491–503, 2023. 11 Topo-ADV: Generating Topology-Driven Imperceptible Adversarial Point CloudsA PREPRINT

2023
[40]

H. Zhao, L. Jiang, J. Jia, P. H. Torr, and V . Koltun. Point transformer. InProceedings of the IEEE/CVF international conference on computer vision, pages 16259–16268, 2021

2021
[41]

Zheng, C

T. Zheng, C. Chen, J. Yuan, B. Li, and K. Ren. Pointcloud saliency maps. InProceedings of the IEEE/CVF international conference on computer vision, pages 1598–1606, 2019

2019
[42]

H. Zhou, K. Chen, W. Zhang, H. Fang, W. Zhou, and N. Yu. Dup-net: Denoiser and upsampler network for 3d adversarial point clouds defense. InProceedings of the IEEE/CVF international conference on computer vision, pages 1961–1970, 2019

1961
[43]

Zhou and O

Y . Zhou and O. Tuzel. V oxelnet: End-to-end learning for point cloud based 3d object detection. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 4490–4499, 2018. 12 Topo-ADV: Generating Topology-Driven Imperceptible Adversarial Point CloudsA PREPRINT Appendix Transferability Table 6 reports the transferability result...

2018