Transferable adversarial attacks on point clouds remain challenging, as existing methods often rely on model-specific gradients or heuristics that limit generalization to unseen architectures. In this paper, we rethink adversarial transferability from a compact subspace perspective and propose CoSA, a transferable attack framework that operates within a shared low-dimensional semantic space. Specifically, each point cloud is represented as a compact combination of class-specific prototypes that capture shared semantic structure, while adversarial perturbations are optimized within a low-rank subspace to induce coherent and architecture-agnostic variations. This design suppresses model-dependent noise and constrains perturbations to semantically meaningful directions, thereby improving cross-model transferability without relying on surrogate-specific artifacts. Extensive experiments on multiple datasets and network architectures demonstrate that CoSA consistently outperforms state-of-the-art transferable attacks, while maintaining competitive imperceptibility and robustness under common defense strategies. Codes will be made public upon paper acceptance.

翻译：点云的可迁移对抗攻击仍然具有挑战性，因为现有方法通常依赖于模型特定的梯度或启发式策略，这限制了其在未见架构上的泛化能力。本文从一个紧凑子空间的视角重新思考对抗可迁移性，提出了CoSA——一种在共享低维语义空间中运行的可迁移攻击框架。具体而言，每个点云被表示为一组类别特定原型的紧凑组合，这些原型捕获了共享的语义结构；同时，对抗扰动在一个低秩子空间内进行优化，以产生一致且与架构无关的变异。该设计抑制了模型依赖的噪声，并将扰动约束在具有语义意义的方向上，从而在不依赖代理模型特定伪影的情况下提高了跨模型的可迁移性。在多个数据集和网络架构上的大量实验表明，CoSA在保持竞争性的不可感知性和常见防御策略下的鲁棒性的同时，持续优于当前最先进的可迁移攻击方法。代码将在论文录用后公开。