skip to main content
10.1145/3581783.3612456acmconferencesArticle/Chapter ViewAbstractPublication PagesmmConference Proceedingsconference-collections
research-article

PointCRT: Detecting Backdoor in 3D Point Cloud via Corruption Robustness

Published: 27 October 2023 Publication History

Abstract

Backdoor attacks for point clouds have elicited mounting interest with the proliferation of deep learning. The point cloud classifiers can be vulnerable to malicious actors who seek to manipulate or fool the model with specific backdoor triggers. Detecting and rejecting backdoor samples during the inference stage can effectively alleviate backdoor attacks. Recently, some black-box test-time backdoor sample detection methods have been proposed in the 2D image domain, without any underlying assumptions about the backdoor triggers. However, upon examination, we have found that these detection techniques are not effective for 3D point clouds. As a result, there is a pressing need to bridge the gap for the development of a universal approach that is specifically designed for 3D point clouds.
In this paper, we propose the first test-time backdoor sample detection method in 3D point cloud without assumption to the backdoor triggers, called Point Clouds Corruption Robustness Test (PointCRT). Based on the fact that the corruption robustness of clean samples remains relatively stable across various backdoor models, we propose the corruption robustness score to map the features into high-dimensional space. The corruption robustness score is a vector evaluated by label consistency, whose element is the minimum severity level of corruption that changes the label prediction of the victim model. Then, the trigger is identified by detecting the abnormal corruption robustness score through a nonlinear classification. The comprehensive experiments demonstrate PointCRT deals with all cases with the average AUC over 0.934 and F1 score over 0.864, with the enhancement of 18%-28% on ModelNet40. Our codes are available at: https://github.com/CGCL-codes/PointCRT.

References

[1]
Angel X. Chang, Thomas Funkhouser, Leonidas Guibas, Pat Hanrahan, Qixing Huang, Zimo Li, Silvio Savarese, Manolis Savva, Shuran Song, Hao Su, et al. 2015. Shapenet: An information-rich 3D model repository. arXiv preprint arXiv:1512.03012 (2015).
[2]
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Ben Edwards, Taesung Lee, Ian Molloy, and B. Srivastava. 2018. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728 (2018).
[3]
Edward Chou, Florian Tramèr, Giancarlo Pellegrino, and Dan Boneh. 2018. SentiNet: Detecting physical attacks against deep learning systems. arXiv preprint arXiv:1812.00292 (2018).
[4]
Yinpeng Dong, Xiao Yang, Zhijie Deng, Tianyu Pang, Zihao Xiao, Hang Su, and Jun Zhu. 2021. Black-box detection of backdoor attacks with limited information and data. In Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision (ICCV'21). 16462--16471.
[5]
Linkun Fan, Fazhi He, Qingchen Guo, Wei Tang, Xiaolin Hong, and Bing Li. 2022. Be careful with rotation: A uniform backdoor pattern for 3D shape. arXiv preprint arXiv:2211.16192 (2022).
[6]
Kuofeng Gao, Jiawang Bai, Baoyuan Wu, Mengxi Ya, and Shutao Xia. 2022. Imperceptible and robust backdoor attack in 3D point cloud. arXiv preprint arXiv:2208.08052 (2022).
[7]
Yansong Gao, Chang Xu, Derui Wang, Shiping Chen, Damith Chinthana Ranasinghe, and Surya Nepal. 2019. STRIP: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference (ACSAC'19). 113--125.
[8]
Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard S. Zemel, Wieland Brendel, Matthias Bethge, and Felix Wichmann. 2020. Shortcut learning in deep neural networks. Nature Machine Intelligence, Vol. 2 (2020), 665--673.
[9]
Ankit Goyal, Hei Law, Bowei Liu, Alejandro Newell, and Jia Deng. 2021. Revisiting point cloud shape classification with a simple and effective baseline. In Proceedings of the 2021 International Conference on Machine Learning (ICML'21), Vol. 139. 3809--3820.
[10]
Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2019. BadNets: Evaluating backdooring attacks on deep neural networks. IEEE Access, Vol. 7 (2019), 47230--47244.
[11]
Jun Guo, Wei Bao, Jiakai Wang, Yuqing Ma, Xinghai Gao, Gang Xiao, Aishan Liu, Jian Dong, Xianglong Liu, and Wenjun Wu. 2023 a. A Comprehensive Evaluation Framework for Deep Model Robustness. Pattern Recognition (2023).
[12]
Junfeng Guo, Ang Li, and Cong Liu. 2022. AEVA: Black-box backdoor detection using adversarial extreme value analysis. In Proceedings of the 2022 International Conference on Learning Representations (ICLR'22).
[13]
Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. 2023 b. SCALE-UP: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. In Proceedings of the 2023 International Conference on Learning Representations (ICLR'23), .
[14]
Mengao Guo, Junxiong Cai, Zhengning Liu, Taijiang Mu, Ralph Robert Martin, and Shimin Hu. 2020. PCT: Point cloud transformer. Computational Visual Media, Vol. 7 (2020), 187--199.
[15]
Abdullah Hamdi, Sara Rojas, Ali K. Thabet, and Bernard Ghanem. 2020. AdvPC: Transferable adversarial perturbations on 3D point clouds. In 16th European Conference on Computer Vision (ECCV'20), 241--257.
[16]
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR'16). 770--778.
[17]
Shengshan Hu, Junwei Zhang, Wei Liu, Junhui Hou, Minghui Li, Leo Yu Zhang, Hai Jin, and Lichao Sun. 2023. PointCA: Evaluating the robustness of 3D point cloud completion models against adversarial examples. In Proceedings of the AAAI Conference on Artificial Intelligence(AAAI'23), Vol. 2023 (Jun. 2023), 872--880.
[18]
Shengshan Hu, Ziqi Zhou, Yechao Zhang, Leo Yu Zhang, Yifeng Zheng, Yuanyuan He, and Hai Jin. 2022. Badhash: Invisible backdoor attacks against deep hashing with clean label. In Proceedings of the 30th ACM International Conference on Multimedia (ACM MM'22). 678--686.
[19]
Qidong Huang, Xiaoyi Dong, Dongdong Chen, Hang Zhou, Weiming Zhang, and Nenghai Yu. 2022. Shape-invariant 3D adversarial point clouds. In Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22). 15314--15323.
[20]
Kaidong Li, Ziming Zhang, Cuncong Zhong, and Guanghui Wang. 2022. Robust structured declarative classifiers for 3D point clouds: Defending adversarial attacks with implicit gradients. In Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22). 15273--15283.
[21]
Xinke Li, Zhirui Chen, Yue Zhao, Zekun Tong, Yabang Zhao, Andrew Lim, and Joey Tianyi Zhou. 2021. PointBA: Towards backdoor attacks in 3D point cloud. In Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision (ICCV'21). 16472--16481.
[22]
Yangyan Li, Rui Bu, Mingchao Sun, Wei Wu, Xinhan Di, and Baoquan Chen. 2018. PointCNN: Convolution on ?-transformed points. In Proceedings of the 32nd International Conference on Neural Information Processing Systems (NeurIPS'18). Curran Associates Inc., 828--838.
[23]
Yiming Li, Tongqing Zhai, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shutao Xia. 2020. Rethinking the trigger of backdoor attack. arXiv preprint arXiv:2004.04692 (2020).
[24]
Qi Liang, Qiang Li, and Song Yang. 2021. LP-GAN: Learning perturbations based on generative adversarial networks for point cloud adversarial attacks. Image Vis. Comput., Vol. 120 (2021), 104370.
[25]
Daizong Liu and Wei Hu. 2023. Imperceptible transfer attack and defense on 3D point cloud classification. IEEE transactions on pattern analysis and machine intelligence, Vol. 45, 4 (2023), 4727--4746.
[26]
Daniel Liu, Ronald Yu, and Hao Su. 2019. Extending adversarial attacks and defenses to deep 3D point cloud classifiers. In Proceedings of the 2019 IEEE International Conference on Image Processing (ICIP'19). 2279--2283.
[27]
Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong. 2021. PointGuard: Provably robust 3D point cloud classification. In Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'21). 6182--6191.
[28]
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018. Fine-Pruning: Defending against backdooring attacks on deep neural networks. In International Symposium on Recent Advances in Intrusion Detection (RAID'18). 273--294.
[29]
Xiaogeng Liu, Minghui Li, Hao Wang, Shengshan Hu, Dengpan Ye, Hai Jin, Libing Wu, and Chaowei Xiao. 2023. Detecting backdoors during the inference stage based on corruption robustness consistency. In Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'23).
[30]
Chengcheng Ma, Weiliang Meng, Baoyuan Wu, Shibiao Xu, and Xiaopeng Zhang. 2020. Efficient joint gradient based attack against SOR defense for 3D point cloud classification. In Proceedings of the 28th ACM International Conference on Multimedia (MM'20). 1819--1827.
[31]
Moritz Menze and Andreas Geiger. 2015. Object scene flow for autonomous vehicles. In Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR' 15).
[32]
A. A. M. Muzahid, Wanggen Wan, Ferdous Sohel, Lianyao Wu, and Li Hou. 2021. CurveNet: Curvature-based multitask learning deep networks for 3D object recognition. IEEE/CAA Journal of Automatica Sinica, Vol. 8, 6 (2021), 1177--1187.
[33]
C. Qi, Hao Su, Kaichun Mo, and Leonidas J. Guibas. 2017a. PointNet: Deep learning on point sets for 3D classification and segmentation. In Proceedings of the 2017 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'17). 77--85.
[34]
C. Qi, L. Yi, Hao Su, and Leonidas J. Guibas. 2017b. PointNet: Deep hierarchical feature learning on point sets in a metric space. In Proceedings of the 31st International Conference on Neural Information Processing Systems (NeurIPS'17). 5105--5114.
[35]
Jiawei Ren, Liang Pan, and Ziwei Liu. 2022. Benchmarking and analyzing point cloud classification under corruptions. arXiv preprint arXiv:2202.03377 (2022).
[36]
Jiachen Sun, Yulong Cao, Christopher Bongsoo Choy, Zhiding Yu, Anima Anandkumar, Zhuoqing Morley Mao, and Chaowei Xiao. 2021. Adversarially robust 3D point cloud recognition using self-supervisions. In Proceedings of the 34st International Conference on Neural Information Processing Systems (NeurIPS'21). 15498--15512.
[37]
Jiachen Sun, Weili Nie, Zhiding Yu, Zhuoqing Morley Mao, and Chaowei Xiao. 2022a. PointDP: Diffusion-driven purification against adversarial attacks on 3D point cloud recognition. arXiv preprint arXiv:2208.09801 (2022).
[38]
Jiachen Sun, Qingzhao Zhang, Bhavya Kailkhura, Zhiding Yu, Chaowei Xiao, and Zhuoqing Morley Mao. 2022b. Benchmarking robustness of 3D point cloud recognition against common corruptions. arXiv preprint arXiv:2201.12296 (2022).
[39]
Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan Zhang. 2021. Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination detection. In Proceedings of the 30th USENIX Security Symposium (USENIX Security'21). USENIX Association, 1541--1558.
[40]
Guiyu Tian, Wenhao Jiang, Wei Liu, and Yadong Mu. 2021. Poisoning MorphNet for clean-label backdoor attack to point clouds. arXiv preprint arXiv:2105.04839 (2021).
[41]
Sakshi Udeshi, Shanshan Peng, Gerald Woo, Lionell Loh, Louth Rawshan, and Sudipta Chattopadhyay. 2022. Model agnostic defence against backdoor attacks in machine learning. IEEE Transactions on Reliability, Vol. 71, 2 (2022), 880--895.
[42]
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. 2019b. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP'19). 707--723.
[43]
Robin Wang, Yibo Yang, and Dacheng Tao. 2022. ART-Point: Improving rotation robustness of point cloud classifiers via adversarial rotation. In Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22). 14351--14360.
[44]
Yue Wang, Yongbin Sun, Ziwei Liu, Sanjay E Sarma, Michael M Bronstein, and Justin M Solomon. 2019a. Dynamic graph cnn for learning on point clouds. In Acm Transactions On Graphics (TOG'19), Vol. 38. 1--12.
[45]
Yuxin Wen, Jiehong Lin, Ke Chen, C. L. Philip Chen, and Kui Jia. 2019. Geometry-aware generation of adversarial point clouds. IEEE Transactions on Pattern Analysis and Machine Intelligence, Vol. 44 (2019), 2984--2999.
[46]
Ziyi Wu, Yueqi Duan, He Wang, Qingnan Fan, and Leonidas J. Guibas. 2020. IF-Defense: 3D adversarial point cloud defense via implicit function based restoration. arXiv preprint arXiv:2010.05272 (2020).
[47]
Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 2015. 3d shapenets: A deep representation for volumetric shapes. In Proceedings of the 2015 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'15). 1912--1920.
[48]
Chong Xiang, C. Qi, and Bo Li. 2018. Generating 3D adversarial point clouds. In Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'19). 9128--9136.
[49]
Zhen Xiang, David J. Miller, Siheng Chen, Xi Li, and George Kesidis. 2021. A backdoor attack against 3D point cloud classifiers. In Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision (ICCV'21). 7577--7587.
[50]
Zhen Xiang, David J. Miller, Siheng Chen, Xi Li, and George Kesidis. 2022. Detecting backdoor attacks against point cloud classifiers. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP'22). 3159--3163.
[51]
Jiancheng Yang, Qiang Zhang, Rongyao Fang, Bingbing Ni, Jinxian Liu, and Qi Tian. 2019. Adversarial attack and defense on point sets. arXiv preprint arXiv:1902.10899 (2019).
[52]
Yue Zhao, Yuwei Wu, Caihua Chen, and Andrew Lim. 2020. On isometry robustness of deep 3D point cloud models under adversarial attacks. In Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'20). 1198--1207.
[53]
Tianhang Zheng, Changyou Chen, Junsong Yuan, Bo Li, and Kui Ren. 2019. PointCloud saliency maps. In Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision (ICCV'19). 1598--1606.
[54]
Hang Zhou, Kejiang Chen, Weiming Zhang, Han Fang, Wenbo Zhou, and Nenghai Yu. 2019. DUP-Net: Denoiser and upsampler network for 3D adversarial point clouds defense. In Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision (ICCV'19). 1961--1970.

Cited By

View all
  • (2024)DarkFedProceedings of the Thirty-Third International Joint Conference on Artificial Intelligence10.24963/ijcai.2024/491(4443-4451)Online publication date: 3-Aug-2024
  • (2024)Detector collapseProceedings of the Thirty-Third International Joint Conference on Artificial Intelligence10.24963/ijcai.2024/185(1670-1678)Online publication date: 3-Aug-2024
  • (2024)Domain Generalization-Aware Uncertainty Introspective Learning for 3D Point Clouds SegmentationProceedings of the 32nd ACM International Conference on Multimedia10.1145/3664647.3681574(651-660)Online publication date: 28-Oct-2024
  • Show More Cited By

Index Terms

  1. PointCRT: Detecting Backdoor in 3D Point Cloud via Corruption Robustness

      Recommendations

      Comments

      Information & Contributors

      Information

      Published In

      cover image ACM Conferences
      MM '23: Proceedings of the 31st ACM International Conference on Multimedia
      October 2023
      9913 pages
      ISBN:9798400701085
      DOI:10.1145/3581783
      Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

      Sponsors

      Publisher

      Association for Computing Machinery

      New York, NY, United States

      Publication History

      Published: 27 October 2023

      Permissions

      Request permissions for this article.

      Check for updates

      Author Tags

      1. 3d point clouds
      2. backdoor detection
      3. deep learning

      Qualifiers

      • Research-article

      Funding Sources

      • National Natural Science Foundation of China
      • National Natural Science Foundation of China
      • Hubei Province Key R&D Technology Special Innovation Project

      Conference

      MM '23
      Sponsor:
      MM '23: The 31st ACM International Conference on Multimedia
      October 29 - November 3, 2023
      Ottawa ON, Canada

      Acceptance Rates

      Overall Acceptance Rate 2,145 of 8,556 submissions, 25%

      Contributors

      Other Metrics

      Bibliometrics & Citations

      Bibliometrics

      Article Metrics

      • Downloads (Last 12 months)152
      • Downloads (Last 6 weeks)6
      Reflects downloads up to 05 Mar 2025

      Other Metrics

      Citations

      Cited By

      View all
      • (2024)DarkFedProceedings of the Thirty-Third International Joint Conference on Artificial Intelligence10.24963/ijcai.2024/491(4443-4451)Online publication date: 3-Aug-2024
      • (2024)Detector collapseProceedings of the Thirty-Third International Joint Conference on Artificial Intelligence10.24963/ijcai.2024/185(1670-1678)Online publication date: 3-Aug-2024
      • (2024)Domain Generalization-Aware Uncertainty Introspective Learning for 3D Point Clouds SegmentationProceedings of the 32nd ACM International Conference on Multimedia10.1145/3664647.3681574(651-660)Online publication date: 28-Oct-2024
      • (2024)ColVO: Colonoscopic Visual Odometry Considering Geometric and Photometric ConsistencyProceedings of the 32nd ACM International Conference on Multimedia10.1145/3664647.3681286(8100-8109)Online publication date: 28-Oct-2024
      • (2024)iBA: Backdoor Attack on 3D Point Cloud via Reconstructing ItselfIEEE Transactions on Information Forensics and Security10.1109/TIFS.2024.345263019(7994-8008)Online publication date: 30-Aug-2024
      • (2024)Robust Backdoor Detection for Deep Learning via Topological Evolution Dynamics2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00174(2048-2066)Online publication date: 19-May-2024
      • (2024)ECLIPSE: Expunging Clean-Label Indiscriminate Poisons via Sparse Diffusion PurificationComputer Security – ESORICS 202410.1007/978-3-031-70879-4_8(146-166)Online publication date: 16-Sep-2024
      • (2024)PointAPA: Towards Availability Poisoning Attacks in 3D Point CloudsComputer Security – ESORICS 202410.1007/978-3-031-70879-4_7(125-145)Online publication date: 16-Sep-2024

      View Options

      Login options

      View options

      PDF

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader

      Figures

      Tables

      Media

      Share

      Share

      Share this Publication link

      Share on social media