🤖 AI Summary
This work presents the first systematic study of backdoor attacks against 3D point cloud models, revealing their superior stealth and threat compared to adversarial attacks. To address this, we propose PointBA—a unified backdoor attack framework supporting both poison-label (PointPBA) and clean-label (PointCBA) paradigms—leveraging spatial transformation vulnerabilities and feature disentanglement for highly stealthy, optimization-friendly backdoor embedding. PointBA is the first dual-paradigm backdoor framework tailored for point clouds and the first to introduce backdoor attacks into 3D deep learning. Extensive experiments demonstrate that PointPBA achieves >95% attack success rate across multiple datasets and models, while PointCBA attains ~50% success with significantly enhanced stealth. This work establishes a benchmark attack methodology for robustness evaluation of 3D models and delivers critical security insights for the emerging field of 3D machine learning.
📝 Abstract
3D deep learning has been increasingly more popular for a variety of tasks including many safety-critical applications. However, recently several works raise the security issues of 3D deep models. Although most of them consider adversarial attacks, we identify that backdoor attack is indeed a more serious threat to 3D deep learning systems but remains unexplored. We present the backdoor attacks in 3D point cloud with a unified framework that exploits the unique properties of 3D data and networks. In particular, we design two attack approaches on point cloud: the poison-label backdoor attack (PointPBA) and the clean- label backdoor attack (PointCBA). The first one is straight-forward and effective in practice, while the latter is more sophisticated assuming there are certain data inspections. The attack algorithms are mainly motivated and developed by 1) the recent discovery of 3D adversarial samples suggesting the vulnerability of deep models under spatial transformation; 2) the proposed feature disentanglement technique that manipulates the feature of the data through optimization methods and its potential to embed a new task. Extensive experiments show the efficacy of the PointPBA with over 95% success rate across various 3D datasets and models, and the more stealthy PointCBA with around 50% success rate. Our proposed backdoor attack in 3D point cloud is expected to perform as a baseline for improving the robustness of 3D deep models.
