[Paper Reading][CVPR 2022] ART-Point: Improving Rotation Robustness of Point Cloud Classifiers via Adversaria

1. Four questions

1. What problem to solve
   Point cloud rotation robustness problem

2. What method was used to solve the problem of min-max alternating training of the adversarial generative model by using the
   rotated samples as adversarial samples to train the one-step method together
   

3. How does it work?
   The proposed rotation attack method achieves a high attack success rate
   The proposed ART-Point framework is robust to rotation and adversarial rotation, and outperforms SOTA on clean datasets

4. What problems still exist?
   4.6. Discussions of Limitations and Society Impact in the article:

   1. Need a trained model
   2. The rotation attack algorithm (which works well), it may be used to attack point cloud-based 3D object detection systems, with potential negative social impact.

2. Introduction to the thesis

Figure 1: The entire pipeline of adversarial training methods

Figure 2:

Figure 3: One-step training method

Experimental results:

Rotation Robustness Test:

Rotation attack method effect:

Comparison of rotation attack methods:

---

1. Introduction

Current point cloud classifiers are vulnerable to just rotating the input. In order to use these classifiers we need to align the inputs, however this is an expensive and time consuming operation. Therefore, how to improve the robustness of point cloud classifiers to arbitrary rotations has become a very popular and necessary research topic.

working nowThere are three ways to solve the robustness of the network to rotational input:

1. Rotation Augmentation Methods
2. Rotation-Invariance
   Methods, usually invariant descriptors can be distance and angle

Typical invariant descriptors can be the distance and angles between local point pairs [4, 8, 47, 48] or point norms [17, 49] and principal directions [47] calculated from global coordinates.

3. Rotation-Equivariance Methods, usually designed from the schema architecture

These methods either require time-consuming preprocessing of the input, or require complex architecture design resulting in limited performance on aligned datasets.

While both methods (2) and (3) can effectively improve model robustness to arbitrary rotations, they either require time-consuming pre-processing on inputs or need complex architectural modifications, which will result in limited performance on clean aligned datasets

---

Our Approach: We attempt to explore a new technical route in point cloud rotation robustness.

Our approach is inspired by: adversarial training [22]

a typical defense method to improve model robustness to attacks.

The idea is straightforward: train the training samples together with the generated adversarial examples (this article treats the rotated data as adversarial examples), so that the model can behave normally when confronted with adversarial examples.

The idea of adversarial training is straightforward: it augments training data with adversarial examples in each training loop. Thus adversarially trained models behave more normally when facing adversarial examples than standardly trained models.

Adversarial training has shown great results in improving the robustness of models to image or text perturbations [9, 11, 21, 34, 44], while maintaining strong discriminative power. In 3D point clouds, [18, 36] also successfully utilize adversarial training to defend against point cloud perturbations such as random point movement or removal.However, few studies have used adversarial training to improve the rotational robustness of point cloud classifiers

to this end,by regarding rotation as an attack,, we propose the ART-Point framework to improve rotation robustness by training the network on inputs with adversarial rotations.

(Adversarial generative models all have a max-minimum loss function problem, so it is not easy to train) Like the general framework for adversarial training, ART Point forms a classic min-max problem, where the max step finds the most aggressive rotation , on which min step is performed to optimize the network parameters to achieve rotational robustness.

Like the general framework of adversarial training, ART-Point forms a classic min-max problem, where the max step finds the most aggressive rotations, on which the min step is performed to optimize the network parameters for rotation robustness.

For the maximization step, we propose an axis-wise rotation attack algorithm to find the most adversarial rotation samples. Compared with the current rotation attack algorithm, which is done directly on the transformation matrix, our method is to do it on the rotation angle.

For the minimization step, the traditional method is followed.

Inspired by ensemble adversarial training [38], we solve min-max problems in one step without alternating training.

Without extracting geometric descriptors and modifying the network architecture, our model works well on clean (aligned) datasets with few limitations and can be integrated into point cloud classifiers.

Experimental datasets: two datasets ModelNet40 [42] and ShapeNet16 [46].
Networks used: We adopt PointNet [30], PointNet++ [31] and DGCNN [39] as the basic classifiers.

contribute:

1. The rotation attack method achieves a higher success rate.
2. The model is more robust to rotations and also robust to adversarial rotations.
3. Performance doesn't decrease much on clean datasets either.

Our contributions are summarized as follows:

1. ART-Point framework, less network modification, no need to extract geometric descriptors from input data
2. Propose an axis-wise rotation attack method, and propose a one-step solution to the min-max problem
3. It proves that the rotation attack method is more effective, and the ART-Point framework is robust to arbitrary or adversarial rotations without affecting the clean data performance.
   

3. References

4. Harvest

• It is a good idea to use rotation samples as adversarial samples to solve the problem of rotation robustness with methods similar to generative adversarial models
• The confrontational generation model needs to alternately train max-min loss. The text says that it can be done in one step, but I don’t understand…