Abstract
Deep neural networks are known to be vulnerable to adversarial examples which are carefully crafted instances to
cause the models to make wrong predictions. While adversarial examples for 2D images and CNNs have been extensively studied, less attention has been paid to 3D data such
as point clouds. Given many safety-critical 3D applications
such as autonomous driving, it is important to study how
adversarial point clouds could affect current deep 3D models. In this work, we propose several novel algorithms to
craft adversarial point clouds against PointNet, a widely
used deep neural network for point cloud processing. Our
algorithms work in two ways: adversarial point perturbation and adversarial point generation. For point perturbation, we shift existing points negligibly. For point generation, we generate either a set of independent and scattered
points or a small number (1-3) of point clusters with meaningful shapes such as balls and airplanes which could be
hidden in the human psyche. In addition, we formulate six
perturbation measurement metrics tailored to the attacks in
point clouds and conduct extensive experiments to evaluate
the proposed algorithms on the ModelNet40 3D shape classification dataset. Overall, our attack algorithms achieve a
success rate higher than 99% for all targeted attacks 1.