Rethinking Gradient-based Adversarial Attacks on Point Cloud Classification

Abstract

Gradient-based adversarial attacks are widely used to evaluate the robustness of 3D point cloud classifiers, yet they often rely on uniform update rules that neglect point-wise heterogeneity, leading to perceptible perturbations. We propose two complementary strategies to improve both the effectiveness and imperceptibility of the attack. \textbf{WAAttack} employs weighted gradients to dynamically adjust per-point perturbation magnitudes and uses an adaptive step size strategy to regulate the global perturbation scale. \textbf{SubAttack} partitions the point cloud into subsets and, at each iteration, perturbs only those combinations with high adversarial efficacy and low perceptual saliency. Together, these methods offer a principled refinement of gradient-based attacks for 3D point clouds. Extensive experiments show that our approach consistently outperforms state-of-the-art methods in generating highly imperceptible adversarial examples. The code is available at https://github.com/chenjun0326/WA_SubAttack.