论文标题
轻推攻击点云DNNS
Nudge Attacks on Point-Cloud DNNs
论文作者
论文摘要
在自动驾驶等安全性关键应用中，3D点云数据的广泛改编使对抗样本成为真正的威胁。现有对点云的对抗性攻击达到了很高的成功率，但会改变大量点，这通常在现实生活中很难做到。在本文中，我们探索了一个只扰动输入点云的几个点的攻击家族，并将其命名为推动攻击。我们证明了轻推攻击可以成功地翻转现代点云DNN的结果。我们提出了两个基于梯度和决策的变体，显示了它们在白色框和灰色盒子方案中的有效性。我们的广泛实验表明，通过从整个点云输入中更改几个点甚至单点，可以有效地生成目标和未靶向对抗点云。我们发现，有了一个点，我们可以在12--80％的案件中可靠地阻止预测，而10分使我们能够将其进一步增加到37---95％。最后，我们讨论可能针对此类攻击的防御措施，并探索其局限性。
The wide adaption of 3D point-cloud data in safety-critical applications such as autonomous driving makes adversarial samples a real threat. Existing adversarial attacks on point clouds achieve high success rates but modify a large number of points, which is usually difficult to do in real-life scenarios. In this paper, we explore a family of attacks that only perturb a few points of an input point cloud, and name them nudge attacks. We demonstrate that nudge attacks can successfully flip the results of modern point-cloud DNNs. We present two variants, gradient-based and decision-based, showing their effectiveness in white-box and grey-box scenarios. Our extensive experiments show nudge attacks are effective at generating both targeted and untargeted adversarial point clouds, by changing a few points or even a single point from the entire point-cloud input. We find that with a single point we can reliably thwart predictions in 12--80% of cases, whereas 10 points allow us to further increase this to 37--95%. Finally, we discuss the possible defenses against such attacks, and explore their limitations.
