Topo-ADV: Generating Topology-Driven Imperceptible Adversarial Point Clouds

1. Problem Statement

Deep neural networks (DNNs) for 3D point cloud understanding (e.g., PointNet, DGCNN) are highly effective for classification and segmentation but remain vulnerable to adversarial attacks.

• Current Limitations: Existing 3D adversarial attacks primarily focus on geometric manipulation (perturbing point coordinates, surface normals, or curvature). These methods implicitly assume that preserving the global geometric shape preserves the object's semantic identity.
• The Gap: This assumption overlooks geometric topology—the intrinsic structural properties of a shape, such as connected components, loops, tunnels, and cavities. The authors hypothesize that 3D classifiers implicitly rely on topological cues and that manipulating the homological structure of an object can induce misclassification even when geometric distortions are imperceptible to humans.
• Goal: To develop the first adversarial attack framework that explicitly optimizes for topological divergence while maintaining geometric imperceptibility.

2. Methodology: Topo-ADV

Topo-ADV is an end-to-end differentiable framework that integrates Persistent Homology (a tool from Topological Data Analysis) directly into the adversarial optimization loop.

A. Core Components

1. Differentiable Persistent Homology Module:

   • The method constructs an Alpha complex filtration from the point cloud to compute persistent homology up to dimension 2 (capturing components, loops, and voids).
   • Since persistence diagrams are multisets and not directly differentiable, the method uses a learnable embedding module ($\phi$). It transforms birth-death pairs $(b_i, d_i)$ into birth-persistence pairs $(b_i, p_i)$, processes them through an MLP, and weights them by their persistence ($p_i$) to create a differentiable vector representation $\phi(P)$.

2. Optimization Objectives:
   The attack minimizes a combined loss function $\mathcal{L} = \lambda_1 \mathcal{L}_{\text{cls}} + \lambda_2 \mathcal{L}_{\text{PH}} + \lambda_3 \mathcal{L}_{\text{geom}}$:

   • Misclassification Loss ($\mathcal{L}_{\text{cls}}$): A Carlini–Wagner margin loss to force the classifier to output an incorrect label with high confidence.
   • Topological Loss ($\mathcal{L}_{\text{PH}}$):
     • Divergence Loss: Penalizes similarity between the clean and adversarial persistence embeddings.
     • Directional Manipulation: A two-phase schedule (Destruction $\to$ Creation) that actively shortens or lengthens the lifetimes of topological features to destabilize or create specific homological structures.
   • Geometric Regularization ($\mathcal{L}_{\text{geom}}$): Ensures the perturbed cloud remains visually plausible. It includes:
     • Chamfer Distance: Limits global point displacement.
     • Normal Consistency: Preserves local tangent-plane orientation.
     • Curvature Consistency: Maintains second-order surface structure.
     • Laplacian Smoothness: Suppresses high-frequency noise.

3. Optimization Procedure:

   • Uses Projected Gradient Descent (PGD).
   • Projections: After each gradient step, perturbations are projected onto the tangent plane of the original surface (removing normal components to prevent "lifting" points off the surface) and constrained within an $\ell_2$ budget ($\epsilon$).
   • Two-Phase Schedule: The topology manipulation starts with a "destruction" phase (weakening existing features) followed by a "creation" phase (forming new structures) to ensure controlled evolution.

3. Key Contributions

• Novel Threat Model: Introduces the first topology-driven adversarial attack for 3D point clouds, shifting the paradigm from purely geometric perturbations to topological manipulation.
• Differentiable Framework: Proposes an end-to-end differentiable pipeline that embeds persistent homology diagrams, allowing gradient-based optimization of topological features.
• Joint Optimization: Simultaneously optimizes for misclassification, topological divergence, and geometric imperceptibility, proving that semantic identity can be broken by altering homology without obvious geometric distortion.
• State-of-the-Art Performance: Demonstrates that topology-driven attacks achieve higher success rates and better imperceptibility scores than existing geometry-driven methods.

4. Experimental Results

The method was evaluated on three benchmark datasets: ModelNet40, ShapeNet Part, and the real-world ScanObjectNN (PB-T50-RS variant), using PointNet and DGCNN as victim models.

• Attack Success Rate (ASR):
  • Topo-ADV achieved ~100% ASR across all datasets and victim models.
  • It consistently outperformed or matched state-of-the-art geometry-based attacks (e.g., HiT-ADV, 3D-ADV, GeoA3).
• Imperceptibility (Geometric Fidelity):
  • Uniform Distance: Topo-ADV significantly outperformed all baselines. For example, on ModelNet40 with PointNet, it achieved a Uniform distance of 0.0121 compared to 0.2883 for the next best method (HiT-ADV), representing a 23.8x improvement. This indicates the point distribution remains statistically consistent with the original.
  • Chamfer Distance: On ModelNet40, Topo-ADV reduced the Chamfer distance to 0.0024 (vs. 0.32 for CFG), showing superior surface fidelity.
  • Curvature (CSD): While CSD was slightly higher than some baselines (indicating local curvature changes), the trade-off resulted in a globally subtle perturbation that humans cannot distinguish.
• Robustness:
  • The attack remained effective even with reduced computational budgets (fewer iterations) and on noisy, real-world data (ScanObjectNN).
  • Ablation: The method works effectively even without random restarts ($R=0$), achieving 99.47% ASR, proving the optimization trajectory is robust.
• Topological Impact: Analysis of Persistence Entropy showed that Topo-ADV primarily disrupts higher-order topological structures (specifically $H_2$, voids), confirming the attack targets the homological signature rather than just noise.

5. Significance

• Security Implications: This work reveals a previously unexplored vulnerability surface in 3D deep learning. It demonstrates that classifiers are highly sensitive to the homological structure of objects, not just their geometric appearance.
• Defense Challenges: Since the perturbations are geometrically imperceptible (preserving surface smoothness and density) but topologically distinct, traditional defense mechanisms relying on geometric smoothing or denoising may fail.
• Future Directions: The paper suggests that future robust 3D models must explicitly account for topological invariants during training, moving beyond purely geometric feature learning.

In summary, Topo-ADV proves that manipulating the "shape of holes" (topology) is a potent and stealthy vector for attacking 3D AI systems, challenging the assumption that geometric fidelity guarantees semantic security.