论文标题
通过规模和剪切转换提高3D对抗攻击的可传递性
Improving transferability of 3D adversarial attacks with scale and shear transformations
论文作者
论文摘要
先前的工作表明，3D点云分类器可能容易受到对抗示例的影响。但是，大多数现有方法都是针对白框攻击的，在该攻击中，分类器的参数和其他信息在攻击中已知，这对于实际应用程序是不现实的。为了提高黑盒分类器的攻击性能，研究社区通常使用基于转移的黑盒攻击。但是，当前3D攻击的可传递性仍然相对较低。为此，本文提出了比例尺和剪切（SS）攻击，以生成具有强大可传递性的3D对抗示例。具体而言，我们随机扩展或剪切输入点云，以使攻击不会过分拟合白色框模型，从而提高攻击的可传递性。广泛的实验表明，本文提出的SS攻击可以与现有的最新（SOTA）3D点云攻击方法无缝结合，以形成更强大的攻击方法，而SS攻击可提高3.6倍的转移性，而不是基线。此外，虽然基本上表现优于基线方法，但SS攻击在各种防御措施下实现了SOTA的可转移性。我们的代码将在https://github.com/cuge1995/ss-attack在线提供
Previous work has shown that 3D point cloud classifiers can be vulnerable to adversarial examples. However, most of the existing methods are aimed at white-box attacks, where the parameters and other information of the classifiers are known in the attack, which is unrealistic for real-world applications. In order to improve the attack performance of the black-box classifiers, the research community generally uses the transfer-based black-box attack. However, the transferability of current 3D attacks is still relatively low. To this end, this paper proposes Scale and Shear (SS) Attack to generate 3D adversarial examples with strong transferability. Specifically, we randomly scale or shear the input point cloud, so that the attack will not overfit the white-box model, thereby improving the transferability of the attack. Extensive experiments show that the SS attack proposed in this paper can be seamlessly combined with the existing state-of-the-art (SOTA) 3D point cloud attack methods to form more powerful attack methods, and the SS attack improves the transferability over 3.6 times compare to the baseline. Moreover, while substantially outperforming the baseline methods, the SS attack achieves SOTA transferability under various defenses. Our code will be available online at https://github.com/cuge1995/SS-attack
