DUP-Net: Denoiser and Upsampler Network for 3D Adversarial Point Clouds Defense
arXiv:1812.11017
Abstract
Neural networks are vulnerable to adversarial examples, which poses a threat to their application in security sensitive systems. We propose a Denoiser and UPsampler Network (DUP-Net) structure as defenses for 3D adversarial point cloud classification, where the two modules reconstruct surface smoothness by dropping or adding points. In this paper, statistical outlier removal (SOR) and a data-driven upsampling network are considered as denoiser and upsampler respectively. Compared with baseline defenses, DUP-Net has three advantages. First, with DUP-Net as a defense, the target model is more robust to white-box adversarial attacks. Second, the statistical outlier removal provides added robustness since it is a non-differentiable denoising operation. Third, the upsampler network can be trained on a small dataset and defends well against adversarial attacks generated from other point cloud datasets. We conduct various experiments to validate that DUP-Net is very effective as defense in practice. Our best defense eliminates 83.8% of C&W and l_2 loss based attack (point shifting), 50.0% of C&W and Hausdorff distance loss based attack (point adding) and 9.0% of saliency map based attack (point dropping) under 200 dropped points on PointNet.
arXiv commentPublished in IEEE ICCV2019
References in corpus (17)
- Adam: A Method for Stochastic Optimization
- Ensemble Adversarial Training: Attacks and Defenses
- Understanding Neural Networks Through Deep Visualization
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Delving into Transferable Adversarial Examples and Black-box Attacks
- Towards Deep Neural Network Architectures Robust to Adversarial Examples
- Perspective Transformer Nets: Learning Single-View 3D Object Reconstruction without 3D Supervision
- Dynamic Graph CNN for Learning on Point Clouds
- A study of the effect of JPG compression on adversarial images
- Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
- NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
- Mitigating Adversarial Effects Through Randomization
- Houdini: Fooling Deep Structured Prediction Models
- Adversarial Attack and Defense on Point Sets
- Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifiers
- PointCloud Saliency Maps
- MeshAdv: Adversarial Meshes for Visual Recognition