Generating Band-Limited Adversarial Surfaces Using Neural Networks
This addresses the challenge of efficient adversarial attacks in 3D computer vision, though it appears incremental as it adapts existing 2D neural network approaches to the 3D domain.
The paper tackles the problem of generating adversarial examples for 3D point-cloud or mesh classifiers, which lags behind 2D methods, by proposing a neural network based on PointNet to create attacks in a single forward run, eliminating the need for per-shape optimization.
Generating adversarial examples is the art of creating a noise that is added to an input signal of a classifying neural network, and thus changing the network's classification, while keeping the noise as tenuous as possible. While the subject is well-researched in the 2D regime, it is lagging behind in the 3D regime, i.e. attacking a classifying network that works on 3D point-clouds or meshes and, for example, classifies the pose of people's 3D scans. As of now, the vast majority of papers that describe adversarial attacks in this regime work by methods of optimization. In this technical report we suggest a neural network that generates the attacks. This network utilizes PointNet's architecture with some alterations. While the previous articles on which we based our work on have to optimize each shape separately, i.e. tailor an attack from scratch for each individual input without any learning, we attempt to create a unified model that can deduce the needed adversarial example with a single forward run.