好也可能变坏：一种通过灵活各向同性重采样对3D点云分类器实施的统一攻击
Good Can Sometimes be Bad: A Unified Attack against 3D Point Cloud Classifier by a Flexible Isotropic Resampling
提出用表面近似与射线采样的各向同性重采样统一实现对抗攻击与后门攻击，并把「提升被攻击点云质量」作为隐蔽性手段，为点云分类器的安全评测提供了可复用的攻击范式与新的隐蔽性评价视角。
原文依据 a unified attack that can adapt to both 3D point cloud backdoor attack and adversarial attack, named UAtt3D
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论为确保3D点云深度神经网络（3D DNN）的鲁棒性，针对推理阶段的3D对抗攻击与针对训练阶段的后门攻击均已被深入研究。这两类攻击的成功通常都要求攻击者具备特定权限。然而在实际场景中，由于部署环境的变化，可获得的权限是不确定的，这使得分别设计的现有对抗攻击或后门攻击失效。为解决该问题，本文提出一种能够同时适配3D点云后门攻击与对抗攻击的统一攻击，命名为UAtt3D。此外，通过观察现有攻击可以发现，它们保证攻击隐蔽性的方式是限制不良扰动，该策略要求尽可能小地移动点位置，这限制了攻击强度，不适用于本文的统一攻击。同时，由于残留的恶意扰动，该策略不可避免地会造成3D点云质量下降。因此，UAtt3D探索了一条保证攻击隐蔽性的新途径：提升被攻击3D点云的质量，而非使其下降。具体而言，为同时兼顾对抗攻击的特征移动与后门攻击的后门特征学习，本文设计了一种灵活的各向同性重采样。它基于表面近似与射线采样重新对齐大多数点的位置。通过对重采样后的点云进行微调，即可得到对抗点云与后门点云。多项实验表明，与现有对抗攻击和后门攻击相比，所提出的UAtt3D在主观与客观两个层面均取得了突出的隐蔽性。同时，其攻击效率也具有竞争力。
英文原文摘要 1827 字符
To ensure the robustness of 3D point cloud Deep Neural Network(3D DNN), 3D adversarial attack targeting the inference stage and backdoor attack targeting the training stage are well studied. The success of both attacks usually requires a specified permissions that attacker must have. However, the obtainable permissions are uncertain due to the deployment environment changes in practical scenarios. This renders existing separately designed adversarial attack or backdoor attack ineffective. To solve this issue, this paper proposes a unified attack that can adapt to both 3D point cloud backdoor attack and adversarial attack, named UAtt3D. Furthermore, by observing existing attacks, their way to promise attack stealthiness is to limit the undesirable perturbation. This strategy requires moving the point position as little as possible, which restricts the attack intensity and is not suitable for our unified attack. Meanwhile, this strategy will inevitably cause a quality decrease on 3D point cloud due to the remaining malicious perturbation. Therefore, our UAtt3D explores a new avenue to guarantee attack stealthiness which improves the quality of attacked 3D point cloud rather than decreasing it. In detail, to simultaneously consider feature movement of adversarial attack and backdoor feature learning of backdoor attack, a flexible isotropic resampling is designed. It realigns the position of most points based on surface approximation and rays sampling. By fine tuning the resampled point cloud, adversarial point cloud and backdoored point cloud are obtained. Several experiments suggest that the proposed UAtt3D achieves outstanding stealthiness comparing with existing adversarial attacks and backdoor attacks from the subjective and objective perspective. Meanwhile, its attack efficiency is competitive.