Transferable and Undefendable Point Cloud Attacks via Medial Axis Transform

Keke Tang; Meie Fang; Peican Zhu; Weilong Peng; Xiaofei Wang; Yuze Gao

REVIEW 3 major objections 5 minor 51 references

Transferable and Undefendable Point Cloud Attacks via Medial Axis Transform

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Perturbing a point cloud's medial axis transform—its skeletal representation of maximal inscribed spheres—rather than its points, makes adversarial examples far more transferable to unseen classifiers and resistant to common defenses.

desk verdict A plausible new entry in the "attack via intrinsic representation" line, but the claimed l∞ budget is not actually enforced, so the headline transferability and undefendability numbers may just reflect larger perturbations. read the letter →

arxiv 2507.18870 v1 pith:OWWBKKZD submitted 2025-07-25 cs.CV

Keke Tang , Yuze Gao , Weilong Peng , Xiaofei Wang , Meie Fang , Peican Zhu This is my paper · ORCID

classification cs.CV

keywords AdversarialattacksPointcloudsDeepneuralnetworksMedialaxistransformTransferabilityUndefendabilityclouddefense3Dclassification

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the right surface to attack in a 3D point cloud is not the point coordinates but the shape's intrinsic skeleton: the medial axis transform (MAT), the set of maximal inscribed spheres whose centers and radii encode the object's structure. It proposes MAT-Adv, an autoencoder-based attack that maps a point cloud into a compact MAT representation, perturbs that representation during optimization, and decodes the result back into an adversarial point cloud, with a dropout strategy that randomly masks half the medial spheres each step to stop the perturbation collapsing onto a few of them. The payoff, demonstrated across three datasets and eight classifier architectures, is what the paper calls "inherent adversarialness": skeleton-level perturbations survive decoding into new surfaces, so they keep fooling classifiers the attacker never saw and keep working after denoising and outlier-removal defenses strip point-level noise. If the claim holds, the practical threat model for 3D perception—black-box, defended deployment in autonomous driving and robotics—is more exposed than point-level attack results suggested.

What carries the argument

The load-bearing object is the learned medial axis transform: an autoencoder whose encoder $E_\Phi$ takes a sampled point cloud (via a PointNet++ backbone) and predicts the representation $\Theta = \langle \mathcal{C}, \mathcal{R}, \mathcal{Z} \rangle$—the centers and radii of the medial spheres plus auxiliary features—through convex-combination weights computed from point features, in the style of the Point2Skeleton encoder; the decoder $D_{\Phi^{-1}}$ reconstructs a point cloud by uniformly sampling eight points on each medial sphere, interpolating sphere features by inverse-distance weights, and refining positions with an MLP. The MAT is the attack surface: the perturbation $\Delta$ is added to $\Theta$, not to the point coordinates, so the decoded cloud inherits structural-level changes that the paper argues are intrinsic to the shape and therefore persist across models and defenses. The second mechanism is a dropout strategy that, at each optimization iteration, randomly keeps perturbations on only half the medial spheres (dropout proportion $\rho = 0.5$), which forces the adversarial signal to spread across the representation instead of overfitting the surrogate classifier.

What would settle it

Take MAT-Adv's output clouds, compute the true maximal per-point perturbation $\max_i \|p_i^{\mathrm{adv}} - p_i\|_\infty$ against the original input, and count how often it exceeds the claimed $\epsilon$ of 0.18 or 0.45; then clip every perturbed point back into the $\epsilon$-ball and re-measure transfer attack success. If a substantial share of examples exceed the budget and clipping collapses the transfer advantage to baseline levels, the central claim—that skeleton-space perturbation itself, not a larger effective budget, drives the gains—is refuted. A complementary check exploits the authors' stated limitation: run the attack on shapes with thin structures or complex topology, where they note MAT extraction is less stable, and see whether transferability drops on exactly those shapes.

Watch

Extended reading notes

Core claim

The paper's central claim is that perturbing the medial axis transform (MAT) representation of a point cloud, rather than the point coordinates themselves, yields adversarial examples that are simultaneously transferable and undefendable. Concretely, MAT-Adv optimizes $\min_\Delta L_{\mathrm{mis}}(f_s, D_{\Phi^{-1}}(\Theta+\Delta), y) + \lambda_1 D_{\mathrm{CD}}(\mathcal{P}, D_{\Phi^{-1}}(\Theta+\Delta)) + \lambda_2 \|\Delta\|_F$, where $\Theta = \langle \mathcal{C}, \mathcal{R}, \mathcal{Z} \rangle$ is the autoencoder's predicted set of medial sphere centers, radii, and auxiliary features, and the attack output is the decoded cloud $D_{\Phi^{-1}}(\Theta+\Delta)$. On ShapeNet Part, ModelNet10, and the real-scanned ScanObjectNN, with $\ell^\infty$ budgets of $\epsilon = 0.18$ and $0.45$, MAT-Adv reports the highest attack success rates in most black-box transfer configurations across PointNet, PointNet++, DGCNN, and PointConv, and against modern targets including CurveNet, PCT, Point Transformer, and Mamba3D. Against five defenses—random sampling, statistical outlier removal, DUP-Net, IF-Defense, and adversarial training—it retains substantially higher success than the baselines in most settings (for example, over 40% under IF-Defense where most baselines fall to roughly 10%). The dropout strategy is part of the mechanism, not a detail: removing it cuts transfer success from 40.83% to 20.88% in one PointNet-to-PointConv configuration.

Load-bearing premise

Everything rests on the decoded adversarial cloud actually staying inside the declared perturbation budget: the attack loss in Eq. (11) penalizes Chamfer distance to the original cloud, and no point-wise projection or clipping onto the $\ell^\infty$ ball is described, so if the true maximal per-point displacement exceeds the claimed $\epsilon$, the comparison against baselines that are constrained to that budget is not apples to apples.

Editorial extensions

If this is right

A surrogate-only attacker now has a plausible field recipe: adversarial clouds generated on one accessible model (DGCNN) mislead architecturally distinct targets such as CurveNet, PCT, Point Transformer, and Mamba3D at rates well above the strongest baselines, so the victim's weights are not needed.
Denoising-style defenses are no longer a reliable countermeasure at the tested budgets: under random sampling, statistical outlier removal, DUP-Net, and IF-Defense, MAT-Adv keeps markedly higher success than point- and frequency-domain baselines in most settings, with white-box success staying above 60% under SRS and DUP-Net on ShapeNet Part.
The ablation results pin the mechanism to the whole representation: perturbing only the sphere centers, only the radii, or only the attached features forfeits most of the transfer gain, so the full $\langle \mathcal{C}, \mathcal{R}, \mathcal{Z} \rangle$ triple must move together.
The dropout component earns its keep: removing the random masking of perturbations drops transfer success from 40.83% to 20.88% in one PointNet-to-PointConv configuration, so the reported results depend on that regularizer, not only on the MAT representation.
On real scanned data (ScanObjectNN) every method's success rises because classifiers are weaker on noisy, incomplete input, yet MAT-Adv still leads most transfer configurations, so the advantage is not confined to clean synthetic shapes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same recipe should transfer to other intrinsic shape representations—signed-distance fields, neural occupancy functions, or other skeletons—which would turn MAT-Adv into a template for representation-space attacks; whether the gains persist for representations without the sphere-sampling decoder is a testable question.
A defense implication the authors do not spell out: because the perturbation lives in medial-sphere space, defenses that only filter or denoise points will systematically miss it; effective countermeasures would need to estimate the medial structure of the input and detect or regularize deviations in sphere centers and radii.
The fixed dropout rate $\rho = 0.5$ is chosen empirically, but the mechanism suggests an annealing or saliency-based schedule—masking only structurally important spheres, or varying $\rho$ during optimization—could push transferability further; this is a direct extension of the paper's own ablation.
The paper's argument that perturbing "intrinsic" structure creates inherent adversarialness could be sharpened by a control experiment: perturb a randomly initialized latent representation of the same dimension with the same decoder and check whether transferability and undefendability drop; if they do not, the geometric content of the MAT, not the representation-space attack recipe, is doing the

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this paper is worth reading but its central quantitative claim is not yet supported. MAT-Adv perturbs the medial axis transform (centers, radii, and associated features) learned by a Point2Skeleton-style autoencoder, with a dropout regularizer on the perturbation mask. That is a genuine new application of MAT to adversarial point clouds, and the idea is coherent. The dropout ablation shows a clear effect, the re-sampling sanity check in Table 7 is a nice external validation of the autoencoder's fidelity, and the writing is clear about the method's rationale.

The soft spots are structural, not cosmetic. Most importantly, the paper claims to operate under l∞ budgets of ε=0.18 and 0.45, but the optimization in Eq. (11) uses Chamfer distance plus a Frobenius regularization on Δ. No clipping, projection, or post-decoding check of actual point displacements is described. Since the decoder samples points on medial spheres and then refines positions with an MLP, small MAT perturbations can amplify into point moves larger than ε. Chamfer is an average, not a bound. So every table comparing MAT-Adv to baselines that do enforce l∞ may be comparing unequal perturbation sizes. ASR is monotone in distortion, so this alone could explain the reported gains. This is the load-bearing issue.

Second, Mani-Adv is cited as the closest prior work in the same program—perturbing an intrinsic representation for transferability and undefendability—but it is never evaluated as a baseline. That omission needs explaining. Third, Table 4 has PointConv rows that are near-identical to the DGCNN rows for the baseline methods, which looks like a copy-paste error and undermines confidence in the reported undefendability results. Code is also withheld, which matters for an empirical attack paper.

If the authors can enforce the budget (or honestly report effective distortion), add Mani-Adv, fix the table, and release code, the contribution could stand. As is, the empirical claims are unverified. I would send this to a serious referee because the idea and the framework are worth scrutiny, but I would not accept it in the current form.

Referee Report

3 major / 5 minor

Summary. The manuscript proposes MAT-Adv, an adversarial attack on 3D point cloud classifiers. Instead of perturbing point coordinates directly, the method trains an autoencoder to map point clouds to a medial axis transform (MAT) representation (centers, radii, and per-sphere features), perturbs that representation through a differentiable optimization (Eq. 11), and decodes the result into an adversarial point cloud. A dropout strategy on the MAT perturbation is introduced to reduce overfitting to the surrogate model. Experiments on ShapeNet Part, ModelNet10, and ScanObjectNN report attack success rates for white-box, transfer, and defended scenarios under l_infinity budgets of 0.18 and 0.45, and claim consistent improvements over 3D-Adv, AdvPC, AOF, PF-Attack, and KNN.

Significance. If the reported numbers are correct, the paper would establish a new and conceptually interesting attack surface: perturbing a compact, interpretable geometric representation rather than raw coordinates, with gains in transferability and undefendability. The paper includes fairly extensive experiments across multiple datasets, classifiers, and defenses, and its ablations on the dropout strategy and on perturbing the MAT components are useful. However, the current manuscript does not demonstrate that the attacks are actually constrained by the claimed l_infinity budgets, and it omits the most closely related baseline (Mani-Adv). These issues put the empirical claims in doubt; the significance is therefore conditional on a corrected evaluation.

major comments (3)

[Sec. 5.1 / Eq. (11)] The paper reports results under l_infinity-norm perturbation budgets of ε=0.18 and ε=0.45, but the optimization in Eq. (11) contains no l_infinity constraint, projection, or clipping. The loss terms are the misclassification loss, the Chamfer distance, and the Frobenius norm on Δ; the decoder in Eqs. (9)–(10) is a learned MLP that can amplify small MAT changes into point displacements larger than ε. Because the Chamfer distance is an average nearest-neighbor loss, it does not bound the maximum displacement. The values in Tables 1–5 may therefore be produced with effective perturbations larger than what the baselines are allowed, and the reported gains could be an artifact of an unequal comparison. The authors should either enforce the l_infinity budget (e.g., project the decoded cloud or clip per-point displacements at each iteration) or compare all methods under a common distortion metric while reporting both the budget and the achieved distortion.
[Sec. 5.1, Baselines] Mani-Adv [10] is the most closely related prior method: it also attacks through an intrinsic representation (a 2D parameter plane) and is explicitly motivated by transferability and undefendability. The manuscript cites and discusses Mani-Adv but never includes it as a baseline in Tables 1–5. Without this comparison, the claim that MAT-Adv significantly outperforms existing state-of-the-art methods is not supported. The authors should add Mani-Adv to the experimental comparison or justify its exclusion.
[Table 4] For ShapeNet Part, the DGCNN and PointConv blocks of Table 4 are identical in the no-defense, SRS, SOR, DUP-Net, and IF-Defense columns for every baseline, including 3D-Adv (100.00, 2.92, 1.77, 4.59, 0.70), AdvPC (98.89, 62.33, 49.04, 40.38, 10.47), and AOF (100.00, 53.25, 48.28, 41.32, 13.04); only the adversarial-training column differs. This suggests a copy-paste error or that the PointConv rows were not measured separately. Either way, the undefendability claims for PointConv are not supported by the reported data.

minor comments (5)

[Table 1] Table 1 contains a stray sentence in the table body after the ModelNet10 PointConv row, reading 'IF-Defense[50],whichcombinesoutlierfilteringwithshapeoptimization; and Adversarial Training [3]...' This appears to be a copy-paste error and should be moved to the caption or removed.
[Table 5] Table 5 uses 'SOS' in the table body where 'SOR' (statistical outlier removal) is intended, and the second column header contains a typo 'Atttack'.
[Table 1] Table 1 has a typo 'PonitNet++' in the ModelNet10 section.
[Eq. (2)] Equation (2) defines an objective with the composed classifier f_t⊕Defend, but this formulation is not used in the method or experiments; consider stating explicitly how defenses are integrated into the evaluation.
[Throughout] The term 'inherent adversarialness' is used throughout but never formally defined; consider replacing it with a more operational term or providing a concrete definition.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: MAT-Adv's transferability and undefendability claims are empirically measured, with no equation-level reduction of a prediction to a fitted value or load-bearing self-citation.

full rationale

The paper's central claims—that perturbing the medial axis transform (MAT) representation yields point cloud adversarial examples with high transferability and undefendability—are empirical findings, not derived from the method's own assumptions. The attack objective in Eq. (11) minimizes a misclassification loss plus Chamfer-distance and Frobenius-norm regularizers; no fitted parameter is renamed as a prediction, and no theoretical quantity is defined in terms of the target outcome. The autoencoder is trained with standard reconstruction losses (Chamfer distance and repulsion loss), and attack success rates are measured on held-out classifiers, datasets, and defense mechanisms. The 'intrinsicness' validation in Table 7, which re-samples 4, 6, and 8 points per medial sphere and measures classification accuracy, is an external consistency check independent of the attack optimization. The paper's narrative term 'inherent adversarialness' is defined by the transfer/undefendability outcomes it is invoked to explain, but this framing is not used to compute any result; no equation reduces an attack-success prediction to the definition of 'inherent adversarialness.' The unenforced l-infinity budget noted in Eq. (11) is a validity and comparability concern, not a circularity: it questions whether MAT-Adv's perturbations stay within the same budget as baselines, but it does not show that any claimed result is equivalent to its own input by construction. Self-citations such as [10] and [7] appear only as related work and are not load-bearing premises for the framework's derivation. Therefore no specific circular step can be exhibited, and the honest finding is no significant circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on three empirical/domain assumptions: the manifold nature of point clouds, the fidelity of the learned MAT representation, and the transferability of MAT-space perturbations. The attack-specific hyperparameters lambda_1, lambda_2, and rho are hand-chosen or ablation-selected. No new physical or conceptual entities are introduced beyond the qualitative term 'inherent adversarialness', which is not a separate entity.

free parameters (3)

lambda_1 = 10 (epsilon=0.18), 1 (epsilon=0.45)
Weight of the geometric distortion term D in Eq. (11), chosen by hand for each perturbation budget.
lambda_2 = 0.1 (epsilon=0.18), 0.01 (epsilon=0.45)
Weight of the MAT perturbation regularization term D_L in Eq. (11).
rho (dropout proportion) = 0.5
Dropout probability for masking MAT perturbations during optimization; selected via ablation in Fig. 6.

assumptions (4)

domain assumption Point clouds are sampled from 2-manifold surfaces embedded in 3D Euclidean space.
Motivates perturbing intrinsic geometry rather than raw points; stated in Section 1 following Mani-Adv.
domain assumption The MAT autoencoder provides a compact representation that faithfully reconstructs point clouds and supports meaningful perturbations.
Core of MAT-Adv; fidelity is shown empirically in Fig. 1 and Table 7, but the authors acknowledge in the Limitation paragraph that stability can degrade on thin or complex shapes.
domain assumption Optimizing perturbations in MAT space with dropout yields adversarial examples that remain effective across models and defenses.
The 'inherent adversarialness' premise is the paper's central conceptual claim; it is only measured indirectly through final attack success rates.
standard math Medial axis transform exists and reconstructs the shape as a union of maximal inscribed spheres.
Classical result cited from Amenta et al. and Sun et al.; used as the mathematical basis of the representation.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Transferable and Undefendable Point Cloud Attacks via Medial Axis Transform." pith.science (2026). https://pith.science/paper/OWWBKKZD

@misc{pith2026250718870,
  author       = {Pith},
  title        = {Pith review of: Transferable and Undefendable Point Cloud Attacks via Medial Axis Transform},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OWWBKKZD}},
  note         = {Machine review of arXiv:2507.18870}
}

read the original abstract

Studying adversarial attacks on point clouds is essential for evaluating and improving the robustness of 3D deep learning models. However, most existing attack methods are developed under ideal white-box settings and often suffer from limited transferability to unseen models and insufficient robustness against common defense mechanisms. In this paper, we propose MAT-Adv, a novel adversarial attack framework that enhances both transferability and undefendability by explicitly perturbing the medial axis transform (MAT) representations, in order to induce inherent adversarialness in the resulting point clouds. Specifically, we employ an autoencoder to project input point clouds into compact MAT representations that capture the intrinsic geometric structure of point clouds. By perturbing these intrinsic representations, MAT-Adv introduces structural-level adversarial characteristics that remain effective across diverse models and defense strategies. To mitigate overfitting and prevent perturbation collapse, we incorporate a dropout strategy into the optimization of MAT perturbations, further improving transferability and undefendability. Extensive experiments demonstrate that MAT-Adv significantly outperforms existing state-of-the-art methods in both transferability and undefendability. Codes will be made public upon paper acceptance.

Figures

Figures reproduced from arXiv: 2507.18870 by the authors.

**Figure 1.** Given a point cloud, we extract its medial axis transform (MAT) representation. The three upsampled point clouds generated from the medial spheres retain the characteristics of the original cloud, and can be correctly classified by a classifier trained on the original data, e.g., PointNet, validating that the MAT representation captures intrinsic features of the point cloud. Tang et al.: Preprint submitted to Elsev… view at source ↗

**Figure 2.** Illustration of our transferable and undefendable point cloud attack framework via medial axis transform (MAT-Adv). Given an input point cloud , we extract its MAT representation using an encoder 𝐷, apply targeted perturbations with a dropout strategy to regularize the optimization, and decode the result via 𝐷−1 to obtain the adversarial point cloud  adv [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗

**Figure 3.** Visualizations of original and adversarial point clouds generated to fool PointNet by different attack methods under an 𝑙∞-norm perturbation budget of 𝜖 = 0.18. The left four columns show examples from ShapeNet Part, and the right four columns are from ModelNet10. The predicted categories before and after attack from left to right are: CHAIR → LAPTOP; TABLE → LAMP; GUITAR → KNIFE; AIRPLANE → TABLE; BATHTUB → TABLE; … view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Ablation analysis of attacking different components of the MAT representation, with adversarial examples generated from DGCNN. Results include both white-box (DGCNN) and transfer evaluations on ShapeNet Part, under 𝑙∞-norm perturbation budgets of (a) 𝜖 = 0.18 and (b) …

**Figure 5.** Figure 5: Visualizations of the original point clouds, extracted medial spheres, perturbed medial spheres, and the adversarial point clouds generated by MAT-Adv. The ground truth and predicted labels are marked in blue and gray below the images [PITH_FULL_IMAGE:figures/full_fig…

**Figure 6.** Figure 6: Effect of dropout probability 𝜌 on transferability, measured by the attack success rate (%) using adversarial examples generated from PointNet, under 𝑙∞-norm perturbation budgets of (a) 𝜖 = 0.18 and (b) 𝜖 = 0.45. Tang et al.: Preprint submitted to Elsevier Page 14 of …

**Figure 7.** Figure 7: Visualizations of original and adversarial point clouds generated to fool PointNet by different attack methods under an 𝑙∞-norm perturbation budget of 𝜖 = 0.18. The top four rows show examples from ModelNet10, and the bottom four rows present examples from ShapeNet Par…

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 49 canonical work pages

[10]

K. Tang, J. Wu, W. Peng, Y. Shi, P. Song, Z. Gu, Z. Tian, W. Wang, Deep manifold attack on point clouds via parameter plane stretching, in: AAAI, Vol. 37, 2023, pp. 2420–2428

work page 2023
[1]

Y. Guo, H. Wang, Q. Hu, H. Liu, L. Liu, M. Bennamoun, Deep learning for 3d point clouds: A survey, TPAMI 43 (12) (2020) 4338– 4364

work page 2020
[2]

Xiang, C

C. Xiang, C. R. Qi, B. Li, Generating 3d adversarial point clouds, in: CVPR, 2019, pp. 9136–9144

work page 2019
[3]

D. Liu, R. Yu, H. Su, Extending adversarial attacks and defenses to deep 3d point cloud classifiers, in: ICIP, 2019, pp. 2279–2283

work page 2019
[4]

D. Liu, W. Hu, Imperceptible transfer attack and defense on 3d point cloud classification, TPAMI 45 (4) (2022) 4727–4746

work page 2022
[5]

K.Tang,L.Huang,W.Peng,D.Liu,X.Wang,Y.Ma,L.Liu,Z.Tian, Flat:Flux-awareimperceptibleadversarialattackson3dpointclouds, in: ECCV, 2024

work page 2024
[6]

Y. Wen, J. Lin, K. Chen, C. P. Chen, K. Jia, Geometry-aware genera- tion of adversarial point clouds, TPAMI 44 (6) (2020) 2984–2999

work page 2020
[7]

K. Tang, Z. Wang, W. Peng, L. Huang, L. Wang, P. Zhu, W. Wang, Z. Tian, Symattack: Symmetry-aware imperceptible adversarial at- tacks on 3d point clouds, in: MM, 2024, pp. 3131–3140

work page 2024

Show all 51 references

[8]

Huang, X

Q. Huang, X. Dong, D. Chen, H. Zhou, W. Zhang, N. Yu, Shape- invariant 3d adversarial point clouds, in: CVPR, 2022, pp. 15335– 15344

2022
[9]

Hamdi, S

A. Hamdi, S. Rojas, A. Thabet, B. Ghanem, Advpc: Transferable adversarial perturbations on 3d point clouds, in: ECCV, 2020, pp. 241–257

2020
[11]

Amenta, S

N. Amenta, S. Choi, R. K. Kolluri, The power crust, unions of balls, and the medial axis transform, Computational Geometry 19 (2-3) (2001) 127–153

2001
[12]

J. Yang, Q. Zhang, R. Fang, B. Ni, J. Liu, Q. Tian, Adversarial attack and defense on point sets, arXiv preprint arXiv:1902.10899 (2019)

2019 arXiv
[13]

H.Wei,H.Tang,X.Jia,Z.Wang,H.Yu,Z.Li,S.Satoh,L.VanGool, Z.Wang,Physicaladversarialattackmeetscomputervision:Adecade survey, TPAMI (2024)

2024
[14]

1598–1606

T.Zheng,C.Chen,J.Yuan,B.Li,K.Ren,Pointcloudsaliencymaps, in: ICCV, 2019, pp. 1598–1606

2019
[15]

Wicker, M

M. Wicker, M. Kwiatkowska, Robustness of 3d deep learning in an adversarial setting, in: CVPR, 2019, pp. 11767–11775

2019
[16]

Y. Zhao, Y. Wu, C. Chen, A. Lim, On isometry robustness of deep 3dpointcloudmodelsunderadversarialattacks,in:CVPR,2020,pp. 1201–1210

2020
[17]

K. Tang, X. He, W. Peng, J. Wu, Y. Shi, D. Liu, P. Zhou, W. Wang, Z.Tian,Manifoldconstraintsforimperceptibleadversarialattackson point clouds, in: AAAI, Vol. 38, 2024, pp. 5127–5135

2024
[18]

24326–24335

T.Lou,X.Jia,J.Gu,L.Liu,S.Liang,B.He,X.Cao,Hideinthicket: Generatingimperceptibleandrationaladversarialperturbationson3d point clouds, in: CVPR, 2024, pp. 24326–24335

2024
[19]

I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adversarial examples, in: ICLR, 2015

2015
[20]

Carlini, D

N. Carlini, D. Wagner, Towards evaluating the robustness of neural networks, in: IEEE Symposium on Security and Privacy, 2017, pp. 39–57

2017
[21]

B. Liu, J. Zhang, J. Zhu, Boosting 3d adversarial attacks with attack- ing on frequency, IEEE Access 10 (2022) 50974–50984

2022
[22]

37, 2023, pp

B.He,J.Liu,Y.Li,S.Liang,J.Li,X.Jia,X.Cao,Generatingtransfer- able3dadversarialpointcloudviarandomperturbationfactorization, in: AAAI, Vol. 37, 2023, pp. 764–772

2023
[23]

H.Chen,S.Zhao,X.Yang,H.Yan,Y.He,H.Xue,F.Qian,H.Su,Anf: Crafting transferable adversarial point clouds via adversarial noise factorization,IEEETransactionsonBigData11(2)(2025)835–847

2025
[24]

Maturana, S

D. Maturana, S. Scherer, Voxnet: A 3d convolutional neural network for real-time object recognition, in: IROS, 2015, pp. 922–928

2015
[25]

C.R.Qi,H.Su,K.Mo,L.J.Guibas,Pointnet:Deeplearningonpoint setsfor3dclassificationandsegmentation,in:CVPR,2017,pp.652– 660

2017
[26]

C. R. Qi, L. Yi, H. Su, L. J. Guibas, Pointnet++: deep hierarchical feature learning on point sets in a metric space, in: NeurIPS, 2017, Tang et al.:Preprint submitted to ElsevierPage 9 of 10 Transferable and Undefendable Point Cloud Attacks via Medial Axis Transform Table 8 I...

2017
[27]

W. Wu, Z. Qi, L. Fuxin, Pointconv: Deep convolutional networks on 3d point clouds, in: CVPR, 2019, pp. 9621–9630

2019
[28]

Y. Li, R. Bu, M. Sun, W. Wu, X. Di, B. Chen, Pointcnn: Convolution on𝜒-transformed points, in: NeurIPS, 2018, pp. 820–830

2018
[29]

Y. Wang, Y. Sun, Z. Liu, S. E. Sarma, M. M. Bronstein, J. M. Solomon, Dynamic graph cnn for learning on point clouds, TOG 38 (5) (2019) 1–12

2019
[30]

H. Zhao, L. Jiang, C.-W. Fu, J. Jia, Pointweb: Enhancing local neighborhood features for point cloud processing, in: CVPR, 2019, pp. 5565–5573

2019
[31]

H. Zhao, L. Jiang, J. Jia, P. H. Torr, V. Koltun, Point transformer, in: ICCV, 2021, pp. 16259–16268

2021
[32]

X. Wu, L. Jiang, P.-S. Wang, Z. Liu, X. Liu, Y. Qiao, W. Ouyang, T. He, H. Zhao, Point transformer v3: Simpler faster stronger, in: CVPR, 2024, pp. 4840–4851

2024
[33]

Liang, X

D. Liang, X. Zhou, W. Xu, X. Zhu, Z. Zou, X. Ye, X. Tan, X. Bai, Pointmamba:Asimplestatespacemodelforpointcloudanalysis,in: NeurIPS, 2024

2024
[34]

Sun, Y.-K

F. Sun, Y.-K. Choi, Y. Yu, W. Wang, Medial meshes–a compact and accuraterepresentationofmedialaxistransform,TVCG22(3)(2015) 1278–1290

2015
[35]

R. Tam, W. Heidrich, Shape simplification based on the medial axis transform, in: VIS, IEEE, 2003, pp. 481–488

2003
[36]

Lerner, H

B. Lerner, H. Guterman, I. Dinstein, Y. Romem, Medial axis transform-based features and a neural network for human chromo- some classification, Pattern Recognition 28 (11) (1995) 1673–1683

1995
[37]

Gayle, P

R. Gayle, P. Segars, M. C. Lin, D. Manocha, Path planning for deformable robots in complex environments, in: RSS, Vol. 2005, 2005, pp. 225–232

2005
[38]

4277–4286

C.Lin,C.Li,Y.Liu,N.Chen,Y.-K.Choi,W.Wang,Point2skeleton: Learningskeletalrepresentationsfrompointclouds,in:CVPR,2021, pp. 4277–4286

2021
[39]

2790–2799

L.Yu,X.Li,C.-W.Fu,D.Cohen-Or,P.-A.Heng,Pu-net:Pointcloud upsampling network, in: CVPR, 2018, pp. 2790–2799

2018
[40]

Srivastava, G

N. Srivastava, G. Hinton, A. Krizhevsky, I. Sutskever, R. Salakhutdi- nov, Dropout: a simple way to prevent neural networks from overfit- ting, The journal of machine learning research 15 (1) (2014) 1929– 1958

2014
[41]

Y. Yang, C. Feng, Y. Shen, D. Tian, Foldingnet: Point cloud auto- encoder via deep grid deformation, in: CVPR, 2018, pp. 206–215

2018
[42]

Yavartanoo, S.-H

M. Yavartanoo, S.-H. Hung, R. Neshatavar, Y. Zhang, K. M. Lee, Polynet: Polynomial neural network for 3d shape recognition with polyshape representation, in: 3DV, 2021, pp. 1014–1023

2021
[43]

L. Yi, V. G. Kim, D. Ceylan, I.-C. Shen, M. Yan, H. Su, C. Lu, Q. Huang, A. Sheffer, L. Guibas, A scalable active framework for region annotation in 3d shape collections, TOG 35 (6) (2016) 1–12

2016
[44]

1588–1597

M.A.Uy,Q.-H.Pham,B.-S.Hua,T.Nguyen,S.-K.Yeung,Revisiting pointcloudclassification:Anewbenchmarkdatasetandclassification model on real-world data, in: Proceedings of the IEEE/CVF interna- tional conference on computer vision, 2019, pp. 1588–1597

2019
[45]

Xiang, C

T. Xiang, C. Zhang, Y. Song, J. Yu, W. Cai, Walk in the cloud: Learning curves for point clouds shape analysis, in: Proceedings of theIEEE/CVFinternationalconferenceoncomputervision,2021,pp. 915–924

2021
[46]

Guo, J.-X

M.-H. Guo, J.-X. Cai, Z.-N. Liu, T.-J. Mu, R. R. Martin, S.-M. Hu, Pct: Point cloud transformer, Computational Visual Media 7 (2021) 187–199

2021
[47]

4995–5004

X.Han,Y.Tang,Z.Wang,X.Li,Mamba3d:Enhancinglocalfeatures for 3d point cloud analysis via state space model, in: Proceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 4995–5004

2024
[48]

T. Tsai, K. Yang, T.-Y. Ho, Y. Jin, Robust adversarial objects against deep learning models, in: AAAI, Vol. 34, 2020, pp. 954–962

2020
[49]

H. Zhou, K. Chen, W. Zhang, H. Fang, W. Zhou, N. Yu, Dup-net: Denoiser and upsampler network for 3d adversarial point clouds defense, in: ICCV, 2019, pp. 1961–1970

2019
[50]

Z. Wu, Y. Duan, H. Wang, Q. Fan, L. J. Guibas, If-defense: 3d adversarialpointclouddefenseviaimplicitfunctionbasedrestoration, arXiv preprint arXiv:2010.05272 (2020)

2020 arXiv
[51]

7203–7212

R.Li,X.Li,C.-W.Fu,D.Cohen-Or,P.-A.Heng,Pu-gan:apointcloud upsampling adversarial network, in: ICCV, 2019, pp. 7203–7212. Tang et al.:Preprint submitted to ElsevierPage 10 of 10 Transferable and Undefendable Point Cloud Attacks via Medial Axis Transform Figure 1:Given a point c...

2019

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [10]

K. Tang, J. Wu, W. Peng, Y. Shi, P. Song, Z. Gu, Z. Tian, W. Wang, Deep manifold attack on point clouds via parameter plane stretching, in: AAAI, Vol. 37, 2023, pp. 2420–2428

work page 2023

[2] [1]

Y. Guo, H. Wang, Q. Hu, H. Liu, L. Liu, M. Bennamoun, Deep learning for 3d point clouds: A survey, TPAMI 43 (12) (2020) 4338– 4364

work page 2020

[3] [2]

Xiang, C

C. Xiang, C. R. Qi, B. Li, Generating 3d adversarial point clouds, in: CVPR, 2019, pp. 9136–9144

work page 2019

[4] [3]

D. Liu, R. Yu, H. Su, Extending adversarial attacks and defenses to deep 3d point cloud classifiers, in: ICIP, 2019, pp. 2279–2283

work page 2019

[5] [4]

D. Liu, W. Hu, Imperceptible transfer attack and defense on 3d point cloud classification, TPAMI 45 (4) (2022) 4727–4746

work page 2022

[6] [5]

K.Tang,L.Huang,W.Peng,D.Liu,X.Wang,Y.Ma,L.Liu,Z.Tian, Flat:Flux-awareimperceptibleadversarialattackson3dpointclouds, in: ECCV, 2024

work page 2024

[7] [6]

Y. Wen, J. Lin, K. Chen, C. P. Chen, K. Jia, Geometry-aware genera- tion of adversarial point clouds, TPAMI 44 (6) (2020) 2984–2999

work page 2020

[8] [7]

K. Tang, Z. Wang, W. Peng, L. Huang, L. Wang, P. Zhu, W. Wang, Z. Tian, Symattack: Symmetry-aware imperceptible adversarial at- tacks on 3d point clouds, in: MM, 2024, pp. 3131–3140

work page 2024