challenging to gen. adv. data on point clouds

• no value to tune
• search space being quite large
• L_p norm not apply to point cloud data

targeted adv. attack

• min D(x, x’) s.t. F(x’) = t’ ==> difficult!
• min f(x’) + wD(x, x’)
  • where f(x’) = (max(Z(x’)[i]) - Z(x’)[t’])
  • diff of logits of other labels from target label
• adv. point perturbation and adv. point gen.(new)
  • initialize to some existing points
  • and shift it while optimizing
• adv. cluster gen.
  • small radius and close to surface

measure of point addition

• Hausdorff distance
• Chamfer

• of points added

…and defence

• PointNet more robust than tradition CNN on MNIST