Deformable 3D Point Cloud Perturbations using Cage-based Deformation for Semantic Consistency

IEEE Transactions on Information Forensics and Security (T-IFS)

Kyo Seok Lee1,  Hak Gu Kim2,†
1Department of Image Science and Arts, Chung-Ang University, South Korea
2Department of Metaverse Convergence, Chung-Ang University, South Korea    †Corresponding Author
Paper (Coming Soon) Code (Coming Soon)

Video Results

Each video contains three shapes: the first is the source point cloud, the second is the target point cloud, and the third is the adversarial example generated from the source under the guidance of the target.

The following videos visualize how the deformation of the cage induces corresponding changes in the source point cloud, resulting in smooth and globally coherent point deformation.

Abstract

Deep neural networks for 3D point cloud analysis are widely used in applications such as autonomous driving and robotics, yet they remain highly vulnerable to adversarial attacks. Existing methods typically minimize point-wise distances to preserve geometry, which constrains perturbations and leads to a trade-off between imperceptibility and attack strength. To address this limitation, we propose a cage-based adversarial deformation framework that generates semantically consistent perturbations aligned with natural intra-class variations. Our method refines a source cage, predicts adversarial cage displacements by fusing source-target features, and computes smooth point-wise offsets using solid-angle- and distance-aware weights. This enables globally coherent deformations that appear natural to humans while effectively misleading classifiers. Extensive experiments on ModelNet40, ShapeNet-Part, and ScanObjectNN show that our approach achieves consistently high attack success rates while simultaneously improving point uniformity and reducing local geometric distortions. Furthermore, the perturbations remain effective against various defense methods.

Method

Overview of the proposed framework integrating MCDM, SAAD, and RBER.

The proposed deformable 3D adversarial perturbation method, which consists of three parts: 1) source cage generation, 2) adversarial cage generation, and 3) deformable 3D point cloud perturbation.

① Source Cage Generation
We first construct a source cage that encloses the source point cloud by initializing a rough cage from a regular icosahedron and progressively refining it to better fit the underlying geometry. An encoder–decoder refinement network predicts per-vertex offsets from the source point cloud feature, allowing the cage to align more faithfully with the shape while providing a stable control structure for subsequent deformation.
② Adversarial Cage Generation
To generate adversarial deformation, we predict adversarial cage displacements by jointly encoding the source and target point clouds and fusing their geometric features. The resulting feature representation is decoded into cage-vertex displacements, producing an adversarial cage that guides the source shape toward target-aligned yet semantically consistent deformation patterns.
③ Deformable 3D Point Cloud Perturbations
Given the adversarial cage, we compute point-wise perturbations by measuring the geometric relationship between each source point and cage vertices through solid-angle and distance-aware weights. Each point is then displaced by a weighted combination of cage-vertex motions, yielding globally coherent, visually plausible deformations that preserve object identity while effectively misleading the classifier.

Qualitative Result

Qualitative comparison with DG-Mesh and Dynamic-2DGS on DG-Mesh and D-NeRF datasets.

The first and fourth columns represent the source point clouds, which are the point clouds to be deformed. The second and fifth columns represent the target point clouds that guide the deformation of the source point clouds. The source point clouds are deformed to match the target point clouds. The third and sixth columns represent the adversarially deformable point cloud examples generated by the proposed perturbations. Regardless of 3D shape changes, the proposed adversarial examples remain visually consistent with the original object category from a human perspective because the source point clouds are smoothly deformed by aligning them with the target point clouds using the enclosing cage.

Ablation Study

Effectiveness of adversarial loss

Ablation on MCDM: baseline vs. multi-canonical deformation across an extended temporal sequence.

To verify that 3D shape deformations in the spatial domain alone are insufficient to induce misclassification of the deep neural network, we conducted classification experiments with and without adversarial loss during training. The deformed point clouds generated by the model trained without adversarial loss were not sufficient to fool the classifier, despite exhibiting 3D shape deformations in the spatial domain. In contrast, the deformed point clouds generated by the model trained with adversarial loss achieved both semantically consistent shape deformation and misclassification.

Effect of Margin Parameter and Target Instance

Effect of Margin Parameter

Effect of the margin parameter on deformable adversarial perturbations.

To analyze the effects of the margin parameter in the adversarial loss on the level of 3D shape deformation in the generated adversarial examples, we find that increasing the margin parameter causes the source point cloud to progressively deform, mimicking characteristics of the target chair such as a higher backrest and a narrower width. This indicates that, as the marginal parameter increases, the proposed method more strongly captures the geometric features of the target point cloud, resulting in a larger overall deformation.

Effect of Target Instance

Effect of target instance selection on deformable adversarial perturbations.

We analyze the influence of the target instance on the proposed deformable adversarial perturbation. The proposed method adaptively deforms the source shape based on the structural characteristics of each target, resulting in adversarial examples that reflect the geometric features of the corresponding targets.

BibTeX

@article{TODO,
  author  = {TODO},
  title   = {Deformable 3D Point Cloud Perturbations using Cage-based Deformation for Semantic Consistency},
  journal = {TODO},
  year    = {2026}
}