arXiv:2511.07029cs.CV2025-11AAAI

提出频域认证框架FreqCert,提升3D点云分类对全局扰动的可证明鲁棒性。

Certified L2-Norm Robustness of 3D Point Cloud Recognition in the Frequency Domain

  • 将点云转至频域,基于谱相似性分块并投票,增强结构稳定性。
  • 在ModelNet40和ScanObjectNN上,认证准确率显著高于现有方法。
  • 适用于自动驾驶等高安全场景,为3D点云防御提供理论支撑。

3D点云分类是自动驾驶、机器人和增强现实等安全关键应用的基础任务。然而,近期研究发现点云分类器易受结构化对抗扰动和几何退化影响,威胁其在关键场景中的部署。现有认证防御仅限于点级扰动,忽略了保留单个点但改变整体结构的细微几何扭曲。本文提出FreqCert,一种突破传统空间域防御的新认证框架,将鲁棒性分析转移到频域,实现对全局L2有界扰动的结构化认证。FreqCert首先通过图傅里叶变换(GFT)转换输入点云,再进行结构化的频域感知子采样,生成多个子点云。每个子云由标准模型独立分类,最终预测通过多数投票得出,且子云划分依据谱相似性而非空间邻近性,使分区在L2扰动下更稳定,并与物体内在结构更一致。我们推导出认证L2鲁棒半径的闭式下界,并在最小且可解释的假设下证明其紧性,建立了频域认证的理论基础。在ModelNet40和ScanObjectNN数据集上的大量实验表明,FreqCert在强扰动下始终具有更高的认证准确率和实际准确率。结果表明,谱表示为3D点云分类的可证明鲁棒性提供了有效路径。

原文摘要 · Abstract (English)

3D point cloud classification is a fundamental task in safety-critical applications such as autonomous driving, robotics, and augmented reality. However, recent studies reveal that point cloud classifiers are vulnerable to structured adversarial perturbations and geometric corruptions, posing risks to their deployment in safety-critical scenarios. Existing certified defenses limit point-wise perturbations but overlook subtle geometric distortions that preserve individual points yet alter the overall structure, potentially leading to misclassification. In this work, we propose FreqCert, a novel certification framework that departs from conventional spatial domain defenses by shifting robustness analysis to the frequency domain, enabling structured certification against global L2-bounded perturbations. FreqCert first transforms the input point cloud via the graph Fourier transform (GFT), then applies structured frequency-aware subsampling to generate multiple sub-point clouds. Each sub-cloud is independently classified by a standard model, and the final prediction is obtained through majority voting, where sub-clouds are constructed based on spectral similarity rather than spatial proximity, making the partitioning more stable under L2 perturbations and better aligned with the object's intrinsic structure. We derive a closed-form lower bound on the certified L2 robustness radius and prove its tightness under minimal and interpretable assumptions, establishing a theoretical foundation for frequency domain certification. Extensive experiments on the ModelNet40 and ScanObjectNN datasets demonstrate that FreqCert consistently achieves higher certified accuracy and empirical accuracy under strong perturbations. Our results suggest that spectral representations provide an effective pathway toward certifiable robustness in 3D point cloud recognition.

点云识别频域认证鲁棒性对抗攻击

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。