Deep neural networks for 3D point cloud understanding have achieved remarkable success in object classification and recognition, yet recent work shows that these models remain highly vulnerable to adversarial perturbations. Existing 3D attacks predominantly manipulate geometric properties such as point locations, curvature, or surface structure, implicitly assuming that preserving global shape fidelity preserves semantic content. In this work, we challenge this assumption and introduce the first topology-driven adversarial attack for point cloud deep learning. Our key insight is that the homological structure of a 3D object constitutes a previously unexplored vulnerability surface. We propose Topo-ADV, an end-to-end differentiable framework that incorporates persistent homology as an explicit optimization objective, enabling gradient-based manipulation of topological features during adversarial example generation. By embedding persistence diagrams through differentiable topological representations, our method jointly optimizes (i) a topology divergence loss that alters persistence, (ii) a misclassification objective, and (iii) geometric imperceptibility constraints that preserve visual plausibility. Experiments demonstrate that subtle topology-driven perturbations consistently achieve up to 100% attack success rates on benchmark datasets such as ModelNet40, ShapeNet Part, and ScanObjectNN using PointNet and DGCNN classifiers, while remaining geometrically indistinguishable from the original point clouds, beating state-of-the-art methods on various perceptibility metrics.

翻译：用于3D点云理解的深度神经网络在物体分类与识别领域取得了显著成功，但近期研究表明，这些模型仍然高度易受对抗性扰动的影响。现有3D攻击主要操纵几何属性，如点位置、曲率或表面结构，隐含假设保持全局形状保真度即可保留语义内容。在本工作中，我们质疑了这一假设，并提出了首个面向点云深度学习的拓扑驱动对抗性攻击。我们的关键洞察在于，3D物体的同调结构构成了一个此前未受探索的脆弱性表面。我们提出Topo-ADV，一个端到端可微框架，将持久同调引入作为显式优化目标，从而在对抗性样本生成过程中实现对拓扑特征的梯度操作。通过可微拓扑表示嵌入持续图，我们的方法联合优化了：(i) 改变持久性的拓扑散度损失，(ii) 分类错误目标，以及 (iii) 保持视觉合理性的几何不可察觉性约束。实验表明，在ModelNet40、ShapeNet Part和ScanObjectNN等基准数据集上，采用PointNet和DGCNN分类器时，由细微拓扑驱动的扰动持续实现了高达100%的攻击成功率，同时在几何上与原始点云无法区分，并在多项感知度量指标上超越了现有最优方法。