Adversarial attacks pose serious challenges for deep neural network (DNN)-based analysis of various input signals. In the case of 3D point clouds, methods have been developed to identify points that play a key role in network decision, and these become crucial in generating existing adversarial attacks. For example, a saliency map approach is a popular method for identifying adversarial drop points, whose removal would significantly impact the network decision. Generally, methods for identifying adversarial points rely on the access to the DNN model itself to determine which points are critically important for the model's decision. This paper aims to provide a novel viewpoint on this problem, where adversarial points can be predicted without access to the target DNN model, which is referred to as a ``no-box'' attack. To this end, we define 14 point cloud features and use multiple linear regression to examine whether these features can be used for adversarial point prediction, and which combination of features is best suited for this purpose. Experiments show that a suitable combination of features is able to predict adversarial points of four different networks -- PointNet, PointNet++, DGCNN, and PointConv -- significantly better than a random guess and comparable to white-box attacks. Additionally, we show that no-box attack is transferable to unseen models. The results also provide further insight into DNNs for point cloud classification, by showing which features play key roles in their decision-making process.

翻译：对抗性攻击对基于深度神经网络（DNN）的各种输入信号分析构成了严峻挑战。在三维点云领域，现有方法已能识别出在网络决策中起关键作用的点，而这些点对生成现有对抗攻击至关重要。例如，显著性图谱方法是一种流行的识别对抗性丢弃点的方式——移除这些点将显著影响网络决策。通常，识别对抗点的方法依赖于对DNN模型本身的访问权限，以确定哪些点对模型决策至关重要。本文旨在针对该问题提出新视角：在无法访问目标DNN模型的情况下预测对抗点，即所谓的“无盒”攻击。为此，我们定义了14个点云特征，并采用多元线性回归考察这些特征能否用于对抗点预测，以及何种特征组合最适合此目的。实验表明，合适的特征组合能够显著优于随机猜测地预测PointNet、PointNet++、DGCNN和PointConv四种不同网络的对抗点，其性能可与白盒攻击相媲美。此外，我们证明无盒攻击可迁移至未见过的模型。研究结果还通过揭示哪些特征在决策过程中发挥关键作用，为点云分类DNN提供了更深入的见解。