Nudge Attacks on Point-Cloud DNNs
This work highlights a significant vulnerability for safety-critical applications like autonomous driving, where small, localized perturbations to point clouds can mislead DNNs.
This paper introduces "nudge attacks" which are adversarial attacks on 3D point-cloud DNNs that only perturb a few points. They demonstrate that changing a single point can reliably thwart predictions in 12-80% of cases, and changing 10 points increases this to 37-95%.
The wide adaption of 3D point-cloud data in safety-critical applications such as autonomous driving makes adversarial samples a real threat. Existing adversarial attacks on point clouds achieve high success rates but modify a large number of points, which is usually difficult to do in real-life scenarios. In this paper, we explore a family of attacks that only perturb a few points of an input point cloud, and name them nudge attacks. We demonstrate that nudge attacks can successfully flip the results of modern point-cloud DNNs. We present two variants, gradient-based and decision-based, showing their effectiveness in white-box and grey-box scenarios. Our extensive experiments show nudge attacks are effective at generating both targeted and untargeted adversarial point clouds, by changing a few points or even a single point from the entire point-cloud input. We find that with a single point we can reliably thwart predictions in 12--80% of cases, whereas 10 points allow us to further increase this to 37--95%. Finally, we discuss the possible defenses against such attacks, and explore their limitations.