Backdoor attacks in 3D point cloud reconstruction get more precise control
Information Blackhole: Exploring Backdoor Mechanism in 3D Point Cloud Reconstruction
Cryptography and Security
Summary
3D point cloud autoencoders help computers understand shapes in 3D, which is important for safe applications. The paper shows that attackers can hide backdoors in these autoencoders, but because these models generate data differently than classifiers, attacks behave differently. The authors introduce a method called Adaptive Gaussian Matching to better control how these hidden backdoors work, stopping unwanted information from leaking and making the attack’s effect more predictable. They tested this on common 3D shape datasets and showed their approach works better than previous attempts.
What this means in practice
- •For 3d model developers: Detect and mitigate more controllable backdoor attacks when reconstructing 3D shapes from point clouds to enhance security in shape processing.
- •For autonomous vehicle teams: Improve robustness of 3D environment reconstruction models against hidden backdoor manipulations that could affect vehicle perception.
Authors
Zhifei Yang, Xiuping Liu, Kuofeng Gao, Junkai Qiu, Meng Liu, Yuhao Bian
Abstract
Point cloud autoencoders are fundamental components for 3D world representation and support many safety-critical downstream applications. Existing studies have extensively investigated backdoor attacks on point cloud classification, whereas backdoor attacks against point cloud autoencoders remain largely unexplored. However, their backdoor behaviors differ substantially due to the intrinsic structural gap between discriminative and generative models. Specifically, a classifier is a discriminative model that separately fits the marginal distributions of benign and malicious data. In contrast, the generative nature of an autoencoder entangles the two within a unified latent distribution, leading to information crosstalk and reduced attack controllability. In this setting, residual source geometric information in malicious data may leak into the clean inference branch, causing the reconstruction to collapse toward the source data. We then propose the Information Blackhole principle, which introduces Gaussian distribution constraints to disentangle latent representations and block interfering information. Building on this principle, we further propose Adaptive Gaussian Matching (AGM), which explicitly regularizes the latent distribution of poisoned samples. By suppressing the propagation of source geometric information from poisoned features to the attacker-specified reconstruction target, AGM improves attack controllability. Extensive quantitative and qualitative experiments on ModelNet and ShapeNetPart demonstrate that the proposed framework improves the attack performance of several standard triggers and reveals the unique operating mechanisms of backdoor attacks against point cloud autoencoders.