Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles

Technical Summary: Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles

Problem Statement
The paper addresses a critical security gap in Connected and Autonomous Vehicles (CAVs): the vulnerability of 3D point cloud datasets used for training perception models to poisoning attacks. While data augmentation (specifically using Generative Adversarial Networks, or GANs) is widely employed to expand limited public datasets and improve model robustness, there is a prevailing assumption that augmentation acts as a "sanitizing" mechanism, potentially diluting or filtering out malicious data. The authors challenge this assumption, hypothesizing that in the context of 3D point clouds—which encode geometric and structural continuity—augmentation may inadvertently amplify poisoned samples and backdoors rather than mitigate them. This is particularly concerning because CAVs rely heavily on public datasets for training, creating a significant attack surface where malicious actors could inject poisoned data that propagates through augmentation pipelines, leading to misclassification or triggered backdoors in deployed systems.

Methodology
The authors propose an empirical evaluation framework to assess the operational impact of poisoning attacks on augmented 3D point cloud data. The methodology involves:

1. Threat Model: The study assumes a "clean-label" adversary with partial control over the training data. The attacker injects poisoned 3D point cloud samples into public datasets at incremental rates (0% to 40%). The poisoning strategy involves randomly removing 50% of points from specific samples without complex ranking, aiming to degrade model performance or embed backdoors while preserving original class labels. The adversary has no knowledge of the victim's model architecture or training process.
2. Experimental Setup:
   • Dataset: The ModelNet dataset is used, specifically selecting two classes for binary classification.
   • Scenarios: Two training scenarios are compared:
     • Baseline: A classifier trained on the original, non-augmented dataset.
     • Augmented: A classifier trained on a dataset where the training set is first augmented using a 3D-GAN framework. Crucially, the poisoning is introduced into the training data before the GAN generates synthetic samples, allowing the GAN to learn and reproduce the poisoned features.
   • Metrics: Performance is evaluated using the F1 score, Matthews Correlation Coefficient (MCC), and Attack Success Rate (ASR). ASR is defined as the increase in false negatives (missed detections of the target class) attributable to the attack.
3. Impact Quantification: To move beyond simple accuracy metrics, the authors employ an operational impact model based on resource and mission dependency graphs. This model maps the ASR (as a probability of failure) to specific CAV operational functions (e.g., Vehicle & Pedestrian Detection, Decision Making) to quantify the likelihood of system-level degradation.

Key Contributions

• Empirical Evaluation of Sanitization: The paper provides a focused case study demonstrating that data augmentation does not necessarily sanitize 3D point cloud data. Instead, under specific conditions, it can amplify the prevalence of poisoned samples.
• Operational Impact Assessment: The authors introduce a method to quantify the downstream effects of poisoning attacks on CAV decision-making processes, linking classifier degradation to operational risks.
• Reproducibility: The complete implementation, including code, datasets, and tools for impact assessment, is publicly released to facilitate further research.

Experimental Results
The experiments reveal that data augmentation significantly exacerbates the impact of poisoning attacks:

• Performance Degradation: As the poisoning rate increases, the classifier's performance degrades in both scenarios. However, the degradation is markedly worse in the augmented scenario. At a 40% poisoning rate, the Baseline scenario maintains an MCC of 0.88 and an ASR of 5.8%, whereas the Augmented scenario drops to an MCC of 0.70 and an ASR of 17.6%.
• Amplification Mechanism: The results suggest that the GAN-based augmentation process reinforces the distributional modes exploited by the attacker, effectively increasing the number of poisoned samples available for training rather than filtering them out.
• Operational Impact: The impact propagation model shows a direct correlation between ASR and operational risk. At a 40% poisoning rate, the probability of the "Decision Making" process being affected rises from 4% in the Baseline scenario to 13% in the Augmented scenario—a more than threefold increase in operational disruption risk.

Significance and Claims
The paper claims that the reliance on public datasets for CAV training creates a critical attack surface that is not mitigated, and may be worsened, by standard data augmentation techniques. The authors assert that their findings validate that poisoning can evade the "sanitizing nature" of augmentation techniques (specifically GANs) in the 3D point cloud domain. Consequently, the study concludes that augmentation can increase the number of poisoned samples and the overall operational impact of attacks, leading to a higher probability of catastrophic failures in autonomous driving decision-making. The work serves as a warning that current assumptions about the safety of augmented datasets in safety-critical systems may be flawed.