{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,25]],"date-time":"2025-11-25T06:28:52Z","timestamp":1764052132965,"version":"3.45.0"},"reference-count":47,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2025,11,25]],"date-time":"2025-11-25T00:00:00Z","timestamp":1764028800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Comput. Sci."],"abstract":"<jats:sec>\n                    <jats:title>Introduction<\/jats:title>\n                    <jats:p>3D point cloud classifiers, while powerful for representing real-world objects and environments, are vulnerable to adversarial perturbations, particularly Universal Adversarial Perturbations (UAPs). These UAPs pose significant security threats due to their input-agnostic nature. Current purification methods exhibit critical limitations: they typically operate independently of the target classifier and treat perturbations as isolated points without considering the coherent, structural nature of UAPs in 3D point clouds (such as outlier-like shapes with continuous curvature). This fundamental oversight limits their effectiveness, primarily because distinguishing between genuine geometric features and structured adversarial patterns presents a significant challenge.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Methods<\/jats:title>\n                    <jats:p>We propose a novel purification framework that leverages model interpretability to identify and remove adversarial regions in a holistic manner. Our approach uniquely identifies influential regions within adversarial samples that maximally impact the classifier's predictions. Recognizing that UAPs often manifest as structured segments rather than random points, we employ graph wavelet transforms to isolate suspicious curvature segments. These identified segments undergo a transplantation test where they are transferred to clean samples; segments are classified as adversarial if this transfer consistently induces misclassification. The identified adversarial regions are then removed to sanitize the point cloud. This model-guided, structure-aware approach treats UAPs as coherent structures rather than isolated perturbations.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results<\/jats:title>\n                    <jats:p>We conducted extensive experiments on two public 3D point cloud datasets using four different state-of-the-art classifiers. Our framework demonstrated remarkable improvements in robustness against various UAP attacks compared to existing purification methods. The results show significant accuracy recovery rates after purification, with consistent performance across different classifier architectures and attack methods. Our method particularly excels at preserving genuine geometric features while removing adversarial structures, maintaining high classification accuracy on clean samples while effectively neutralizing UAP threats.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Discussion<\/jats:title>\n                    <jats:p>Our findings demonstrate that considering the structural nature of UAPs and leveraging model interpretability are crucial for effective defense. Unlike previous point-wise approaches, our framework's ability to identify and process coherent adversarial segments addresses the fundamental limitation in current purification methods. The transplantation test provides a reliable mechanism to distinguish between legitimate features and adversarial artifacts. This work highlights the importance of model-guided purification strategies and opens new directions for defending geometric deep learning systems against structured adversarial attacks. Future work could extend this approach to other geometric data representations and explore adaptive defense mechanisms against evolving attack strategies.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.3389\/fcomp.2025.1626359","type":"journal-article","created":{"date-parts":[[2025,11,25]],"date-time":"2025-11-25T06:25:24Z","timestamp":1764051924000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Segments-aware universal adversarial perturbations purification on 3D point cloud classifiers"],"prefix":"10.3389","volume":"7","author":[{"given":"Yang","family":"Gao","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xianrui","family":"Chang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haoran","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jian","family":"Xu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1965","published-online":{"date-parts":[[2025,11,25]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"113816","DOI":"10.1016\/j.eswa.2020.113816","article-title":"Self-driving cars: a survey","volume":"165","author":"Badue","year":"2021","journal-title":"Expert Syst. Appl"},{"key":"B2","article-title":"Mirrorattack: backdoor attack on 3D point cloud with a distorting mirror","author":"Bian","year":"2024","journal-title":"arXiv preprint arXiv:2403.05847"},{"key":"B3","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1109\/SP.2017.49","article-title":"\u201cTowards evaluating the robustness of neural networks,\u201d","volume-title":"2017 IEEE Symposium on Security and Privacy (SP)","author":"Carlini","year":"2017"},{"key":"B4","article-title":"\u201cReliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,\u201d","author":"Croce","year":"2020","journal-title":"Proceedings of the 37th International Conference on Machine Learning"},{"key":"B5","doi-asserted-by":"publisher","first-page":"1267","DOI":"10.1109\/TIFS.2023.3333687","article-title":"Imperceptible and robust backdoor attack in 3d point cloud","volume":"19","author":"Gao","year":"2023","journal-title":"IEEE Trans. Inf. Forens. Secur"},{"key":"B6","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv preprint arXiv:1412.6572"},{"key":"B7","doi-asserted-by":"publisher","first-page":"99","DOI":"10.1016\/j.paerosci.2017.04.003","article-title":"Classifications, applications, and design challenges of drones: a review","volume":"91","author":"Hassanalian","year":"2017","journal-title":"Progr. Aerospace Sci"},{"key":"B8","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3612456","article-title":"\u201cPointcrt: detecting backdoor in 3D point cloud via corruption robustness,\u201d","author":"Hu","year":"2023","journal-title":"Proceedings of the 31st ACM International Conference on Multimedia"},{"key":"B9","first-page":"16216","article-title":"\u201cRethinking backdoor attacks,\u201d","volume-title":"International Conference on Machine Learning","author":"Khaddaj","year":"2023"},{"key":"B10","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30129","article-title":"\u201cPointcvar: risk-optimized outlier removal for robust 3D point cloud classification,\u201d","author":"Li","year":"2024","journal-title":"Proceedings of the AAAI Conference on Artificial Intelligence"},{"key":"B11","doi-asserted-by":"publisher","first-page":"3079","DOI":"10.1109\/TPAMI.2023.3339130","article-title":"Point cloud attacks in graph spectral domain: when 3D geometry meets graph signal processing","volume":"46","author":"Liu","year":"2023","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell"},{"key":"B12","article-title":"Diffusion-driven purification against adversarial attacks on 3D point cloud recognition","author":"Luo","year":"2021","journal-title":"arXiv preprint arXiv:2111.00420"},{"key":"B13","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413875","article-title":"\u201cEfficient joint gradient based attack against sor defense for 3D point cloud classification,\u201d","author":"Ma","year":"2020","journal-title":"Proceedings of the 28th ACM International Conference on Multimedia"},{"key":"B14","article-title":"Rethinking network design and local geometry in point cloud: a simple residual MLP framework","author":"Ma","year":"2022","journal-title":"arXiv preprint arXiv:2202.07123"},{"key":"B15","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv preprint arXiv:1706.06083"},{"key":"B16","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00459","article-title":"\u201cOccupancy networks: Learning 3d reconstruction in function space,\u201d","author":"Mescheder","year":"2019","journal-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition"},{"key":"B17","doi-asserted-by":"crossref","first-page":"2048","DOI":"10.1109\/SP54263.2024.00174","article-title":"\u201cRobust backdoor detection for deep learning via topological evolution dynamics,\u201d","volume-title":"2024 IEEE Symposium on Security and Privacy (SP)","author":"Mo","year":"2024"},{"key":"B18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17","article-title":"\u201cUniversal adversarial perturbations,\u201d","author":"Moosavi-Dezfooli","year":"2017","journal-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition"},{"key":"B19","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282","article-title":"\u201cDeepfool: a simple and accurate method to fool deep neural networks,\u201d","author":"Moosavi-Dezfooli","year":"2016","journal-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition"},{"key":"B20","doi-asserted-by":"publisher","first-page":"2452","DOI":"10.1109\/TPAMI.2018.2861800","article-title":"Generalizable data-free objective for crafting universal adversarial perturbations","volume":"41","author":"Mopuri","year":"2019","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell"},{"key":"B21","article-title":"Fast feature fool: a data independent approach to universal adversarial perturbations","author":"Mopuri","year":"2017","journal-title":"arXiv preprint arXiv:1707.05572"},{"key":"B22","doi-asserted-by":"publisher","first-page":"1893","DOI":"10.1109\/JBHI.2014.2344095","article-title":"Systematic poisoning attacks on and defenses for machine learning in healthcare","volume":"19","author":"Mozaffari-Kermani","year":"2014","journal-title":"IEEE J. Biomed. Health Inf"},{"key":"B23","doi-asserted-by":"publisher","first-page":"144274","DOI":"10.1109\/ACCESS.2023.3345000","article-title":"Adversarial attacks and defenses on 3D point cloud classification: a survey","volume":"11","author":"Naderi","year":"2023","journal-title":"IEEE Access"},{"key":"B24","first-page":"488","article-title":"\u201cImplicit gradient defense for point cloud networks,\u201d","volume-title":"European Conference on Computer Vision","author":"Pang","year":"2020"},{"key":"B25","first-page":"523","article-title":"\u201cConvolutional occupancy networks,\u201d","volume-title":"European Conference on Computer Vision","author":"Peng","year":"2020"},{"key":"B26","doi-asserted-by":"publisher","first-page":"821","DOI":"10.1080\/01691864.2017.1365009","article-title":"Deep learning in robotics: a review of recent research","volume":"31","author":"Pierson","year":"2017","journal-title":"Adv. Robot"},{"key":"B27","first-page":"652","article-title":"\u201cPointnet: deep learning on point sets for 3D classification and segmentation,\u201d","author":"Qi","year":"","journal-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition"},{"key":"B28","first-page":"5099","article-title":"\u201cPointNet++: deep hierarchical feature learning on point sets in a metric space,\u201d","author":"Qi","year":"","journal-title":"Advances in Neural Information Processing Systems"},{"key":"B29","doi-asserted-by":"publisher","first-page":"4230","DOI":"10.1111\/cgf.13753","article-title":"Pointcleannet: Learning to denoise and remove outliers from point clouds","volume":"43","author":"Rachmiel","year":"2020","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell"},{"key":"B30","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74","article-title":"\u201cGrad-cam: visual explanations from deep networks via gradient-based localization,\u201d","author":"Selvaraju","year":"2017","journal-title":"Proceedings of the IEEE International Conference on Computer Vision"},{"key":"B31","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2014","journal-title":"arXiv preprint arXiv:1312.6199"},{"key":"B32","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i6.28318","article-title":"\u201cManifold constraints for imperceptible adversarial attacks on point clouds,\u201d","author":"Tang","year":"2024","journal-title":"AAAI"},{"key":"B33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72658-3_12","article-title":"\u201cFlat: flux-aware imperceptible adversarial attacks on 3D point clouds,\u201d","author":"Tang","year":"2025","journal-title":"ECCV"},{"key":"B34","doi-asserted-by":"publisher","first-page":"5158","DOI":"10.1109\/JIOT.2022.3222159","article-title":"Rethinking perturbation directions for imperceptible adversarial attacks on point clouds","volume":"10","author":"Tang","year":"","journal-title":"IEEE Internet Things J"},{"key":"B35","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i2.25338","article-title":"\u201cDeep manifold attack on point clouds via parameter plane stretching,\u201d","author":"Tang","year":"","journal-title":"AAAI"},{"key":"B36","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3326362","article-title":"Dynamic graph CNN for learning on point clouds","volume":"38","author":"Wang","year":"2019","journal-title":"ACM Trans. Graph"},{"key":"B37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00985","article-title":"\u201cPointconv: deep convolutional networks on 3D point clouds,\u201d","author":"Wu","year":"2019","journal-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition"},{"key":"B38","article-title":"If-defense: 3d adversarial point cloud defense via implicit function based restoration","author":"Wu","year":"2020","journal-title":"arXiv preprint arXiv:2010.05272"},{"key":"B39","article-title":"Adversarial attack and defense on point sets","author":"Yang","year":"2019","journal-title":"arXiv preprint arXiv:1902.10899"},{"key":"B40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00295","article-title":"\u201cPu-net: point cloud upsampling network,\u201d","author":"Yu","year":"2018","journal-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition"},{"key":"B41","first-page":"4601","article-title":"\u201cPointfilternet: a filtering network for point cloud denoising,\u201d","volume-title":"2020 IEEE International Conference on Robotics and Automation (ICRA)","author":"Yuan","year":"2020"},{"key":"B42","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01453","article-title":"\u201cUnderstanding adversarial examples from the mutual influence of images and perturbations,\u201d","author":"Zhang","year":"2020","journal-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition"},{"key":"B43","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00777","article-title":"\u201cData-free universal adversarial perturbation and black-box attack,\u201d","author":"Zhang","year":"2021","journal-title":"Proceedings of the IEEE\/CVF International Conference on Computer Vision"},{"key":"B44","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671910","article-title":"\u201cRethinking graph backdoor attacks: a distribution-preserving perspective,\u201d","author":"Zhang","year":"2024","journal-title":"Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining"},{"key":"B45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00205","article-title":"\u201cDup-net: denoiser and upsampler network for 3D adversarial point clouds defense,\u201d","author":"Zhou","year":"2019","journal-title":"Proceedings of the IEEE\/CVF International Conference on Computer Vision"},{"key":"B46","first-page":"11477","article-title":"\u201cPointba: towards backdoor attacks in 3D point cloud,\u201d","author":"Zhou","year":"2020","journal-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition"},{"key":"B47","doi-asserted-by":"publisher","first-page":"110532","DOI":"10.1016\/j.patcog.2024.110532","article-title":"Advancements in point cloud data augmentation for deep learning: a survey","volume":"153","author":"Zhu","year":"2024","journal-title":"Pattern Recognit"}],"container-title":["Frontiers in Computer Science"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fcomp.2025.1626359\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,25]],"date-time":"2025-11-25T06:25:26Z","timestamp":1764051926000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fcomp.2025.1626359\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,25]]},"references-count":47,"alternative-id":["10.3389\/fcomp.2025.1626359"],"URL":"https:\/\/doi.org\/10.3389\/fcomp.2025.1626359","relation":{},"ISSN":["2624-9898"],"issn-type":[{"value":"2624-9898","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,25]]},"article-number":"1626359"}}