Minimal Adversarial Examples for Deep Learning on 3D Point Clouds

With the recent developments of convolutional neural networks, deep learning for 3D point clouds has shown significant progress in various 3D scene understanding tasks including 3D object recognition. In a safety-critical environment, it is however not well understood how such neural networks are vulnerable to adversarial examples. In this work, we explore adversarial attacks for point cloud-based neural networks with a focus on real-world data. We propose a general formulation for adversarial point cloud generation via $\ell_0$-norm optimisation. Our method generates adversarial examples by attacking the classification ability of the point cloud-based networks while considering the perceptibility of the examples and ensuring the minimum level of point manipulations. The proposed method is general and can be realised in different attack strategies. Experimental results show that our method achieves the state-of-the-art performance with 80\% of attack success rate while manipulating only about 4\% of the points. We also found that compared with synthetic data, real-world point cloud classification is more vulnerable to attacks.