3D point clouds play pivotal roles in various safety-critical fields, such as autonomous driving, which desires the corresponding deep neural networks to be robust to adversarial perturbations. Though a few defenses against adversarial point cloud classification have been proposed, it remains unknown whether they can provide real robustness. To this end, we perform the first security analysis of state-of-the-art defenses and design adaptive attacks on them. Our 100% adaptive attack success rates demonstrate that current defense designs are still vulnerable. Since adversarial training (AT) is believed to be the most effective defense, we present the first in-depth study showing how AT behaves in point cloud classification and identify that the required symmetric function (pooling operation) is paramount to the model's robustness under AT. Through our systematic analysis, we find that the default used fixed pooling operations (e.g., MAX pooling) generally weaken AT's performance in point cloud classification. Still, sorting-based parametric pooling operations can significantly improve the models' robustness. Based on the above insights, we further propose DeepSym, a deep symmetric pooling operation, to architecturally advance the adversarial robustness under AT to 47.0% without sacrificing nominal accuracy, outperforming the original design and a strong baseline by 28.5% ($\sim 2.6 \times$) and 6.5%, respectively, in PointNet.

中文翻译：

---

3D点云分类的对抗鲁棒性

3D点云在各种安全关键领域（例如自动驾驶）中扮演着关键角色，这需要相应的深度神经网络对对抗性摄动具有鲁棒性。尽管已经提出了一些对抗点云分类的防御措施，但是它们是否能够提供真正的鲁棒性仍是未知的。为此，我们对最先进的防御进行了首次安全分析，并针对这些防御设计了自适应攻击。我们100％的自适应攻击成功率表明，当前的防御设计仍然很脆弱。由于对抗训练（AT）被认为是最有效的防御措施，因此我们将进行首次深入研究，以显示AT在点云分类中的行为方式，并确定所需的对称函数（合并操作）对于AT下模型的鲁棒性至关重要。通过我们的系统分析，我们发现默认使用的固定池化操作（例如MAX池化）通常会削弱AT在点云分类中的性能。尽管如此，基于排序的参数池操作仍可以显着提高模型的鲁棒性。基于以上见解，我们进一步提出了DeepSym（一种深度对称池操作），以在不牺牲名义精度的情况下将AT下的对抗性稳健性提高到47.0％，优于原始设计和强大的基线28.5％（$ sim 2.6 \ PointNet）和6.5％。基于排序的参数化池操作可以显着提高模型的鲁棒性。基于以上见解，我们进一步提出了DeepSym（一种深度对称池操作），以在不牺牲名义精度的情况下将AT下的对抗性稳健性提高到47.0％，优于原始设计和强大的基线28.5％（$ sim 2.6 \ PointNet）和6.5％。基于排序的参数化池操作可以显着提高模型的鲁棒性。基于以上见解，我们进一步提出了DeepSym（一种深度对称池操作），以在不牺牲名义精度的情况下将AT下的对抗性稳健性提高到47.0％，优于原始设计和强大的基线28.5％（$ sim 2.6 \ PointNet）和6.5％。