Affiliation:
1. School of Computer Science and Technology, Fudan university , 220 Handan Road, Shanghai 200433, China
Abstract
Abstract
Deep neural networks are vulnerable to backdoor attacks. Previous backdoor attacks have mainly focused on images. Unlike images composed of regular pixels, 3D point clouds are composed of irregular three-dimensional XYZ coordinates, which are widely used in areas such as autonomous driving and 3D measurement. As many deep neural networks have been developed for processing 3D point clouds, these networks also face the risk of backdoor attacks. Nevertheless, backdoor attacks on 3D point clouds have rarely been investigated. This paper proposes a stealthy backdoor attack on point clouds in the physical world, aiming to generate trainable non-rigid deformations as backdoor patterns. Instead of directly adding backdoor patterns onto the point clouds, we deform the 3D space of the point clouds to a new space, ensuring that all point clouds have the same backdoor deformation. We use point cloud alignment to overcome the inconsistency of backdoor deformation caused by shifting and scaling in the physical world. We also propose a physical transformation layer to combat the physical transformations. Additionally, we propose mask contrast learning to eliminate pseudo backdoor patterns to make the network’s backdoor property stealthier. Extensive experiments indicate that the proposed method can achieve better attack success rates and stealthiness.
Funder
Natural Science Foundation of China
Publisher
Oxford University Press (OUP)
Reference49 articles.
1. Self-training with noisy student improves imagenet classification;Xie,2020
2. Imagenet classification with deep convolutional neural networks;Krizhevsky;Commun. ACM,2017
3. Fast point r-cnn;Chen,2019
4. Bisenet: bilateral segmentation network for real-time semantic segmentation;Yu,2018
5. Ccnet: Criss-cross attention for semantic segmentation;Huang,2019