提出一种隐蔽的3D点云局部触发后门攻击方法。
Stealthy Patch-Wise Backdoor Attack in 3D Point Cloud via Curvature Awareness
- 将点云分块，基于曲率选择不可见区域注入触发器。
- 相比样本级攻击，计算量降低98.43%，隐蔽性更强。
- 适合研究3D模型安全的人员关注。
后门攻击通过植入隐藏触发器，可在特定条件下恶意操控深度神经网络行为。现有3D点云后门攻击多采用样本级触发器，常导致明显几何失真或高优化成本。为此，本文提出隐蔽的局部块后门攻击（SPBA）框架：将点云分解为由远点采样中心及其K近邻构成的局部块，基于局部曲率变化评估块的不可见性得分，仅扰动原有点坐标注入统一谱触发器，保持点数不变。在ModelNet40和ShapeNetPart上的实验表明，SPBA在隐蔽性上达到当前最佳水平，相较于样本级谱基基准，谱触发计算量降低98.43%，同时保持良好攻击效果。结果验证了局部谱设计在3D点云模型中实现高效隐蔽后门的有效性。代码已开源。
原文摘要 · Abstract (English)
Backdoor attacks pose a severe threat to deep neural networks (DNNs) by implanting hidden backdoors that can be activated with predefined triggers to manipulate model behaviors maliciously. Recent studies have extended backdoor attacks to 3D point clouds, but most existing triggers are sample-wise and often cause visible geometric artifacts or high optimization cost. To address these limitations, we propose the Stealthy Patch-Wise Backdoor Attack (SPBA), a patch-wise backdoor attack framework for 3D point clouds. Specifically, SPBA decomposes a point cloud into local patches, where each patch is formed by a Farthest Point Sampling (FPS) center and its K-nearest neighbors (KNN). Candidate patches are ranked using a patch imperceptibility score derived from local curvature variation, and a unified spectral trigger is injected into the selected patches by perturbing only the coordinates of existing points while preserving the original point cardinality. Extensive experiments on ModelNet40 and ShapeNetPart further demonstrate that SPBA achieves state-of-the-art stealthiness among prior methods and reduces spectral-trigger computation by 98.43% relative to a sample-wise spectral baseline, while maintaining competitive attack performance. These results support localized spectral design as an effective and efficient approach to stealthy backdoor attacks in 3D point cloud models. Code is available at https://github.com/HazardFY/SPBA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。