Abstract:With the thriving of deep learning in processing point cloud data, recent works show that backdoor attacks pose a severe security threat to 3D vision applications. The attacker injects the backdoor into the 3D model by poisoning a few training samples with trigger, such that the backdoored model performs well on clean samples but behaves maliciously when the trigger pattern appears. Existing attacks often insert some additional points into the point cloud as the trigger, or utilize a linear transformation (e.g., rotation) to construct the poisoned point cloud. However, the effects of these poisoned samples are likely to be weakened or even eliminated by some commonly used pre-processing techniques for 3D point cloud, e.g., outlier removal or rotation augmentation. In this paper, we propose a novel imperceptible and robust backdoor attack (IRBA) to tackle this challenge. We utilize a nonlinear and local transformation, called weighted local transformation (WLT), to construct poisoned samples with unique transformations. As there are several hyper-parameters and randomness in WLT, it is difficult to produce two similar transformations. Consequently, poisoned samples with unique transformations are likely to be resistant to aforementioned pre-processing techniques. Besides, the distortion caused by a fixed WLT is both controllable and smooth, resulting in the generated poisoned samples that are imperceptible to human inspection. Extensive experiments on three benchmark datasets and four models show that IRBA achieves attack success rate (ASR) in most cases even with pre-processing techniques, which is significantly higher than previous state-of-the-art attacks. Our code is available at https://github.com/KuofengGao/IRBA.

IPA-NeRF: Illusory Poisoning Attack Against Neural Radiance Fields

NeRFail: Neural Radiance Fields-Based Multiview Adversarial Attack

Fooling Neural Network Interpretations - Adversarial Noise to Attack Images.

Shielding the Unseen: Privacy Protection through Poisoning NeRF with Spatial Deformation

Steganography for Neural Radiance Fields by Backdooring

IPR-NeRF: Ownership Verification meets Neural Radiance Field

IE-NeRF: Inpainting Enhanced Neural Radiance Fields in the Wild

Targeted Adversarial Attacks on Generalizable Neural Radiance Fields

Hallucinated Neural Radiance Fields in the Wild

Noise-NeRF: Hide Information in Neural Radiance Fields using Trainable Noise

Aleth-NeRF: Illumination Adaptive NeRF with Concealing Field Assumption

Adv3D: Generating 3D Adversarial Examples for 3D Object Detection in Driving Scenarios with NeRF

NeRF On-the-go: Exploiting Uncertainty for Distractor-free NeRFs in the Wild

PANeRF: Pseudo-view Augmentation for Improved Neural Radiance Fields Based on Few-shot Inputs

MarkNerf:Watermarking for Neural Radiance Field

Where and How: Mitigating Confusion in Neural Radiance Fields from Sparse Inputs

Aleth-NeRF: Low-light Condition View Synthesis with Concealing Fields

NeRF-In: Free-Form NeRF Inpainting with RGB-D Priors

Aug-NeRF: Training Stronger Neural Radiance Fields with Triple-Level Physically-Grounded Augmentations

Imperceptible and Robust Backdoor Attack in 3D Point Cloud

Invisible Poisoning: Highly Stealthy Targeted Poisoning Attack