ε-Mesh Attack：一种用于面部表情识别的基于表面的对抗性点云攻击
epsilon-Mesh Attack: A Surface-based Adversarial Point Cloud Attack for Facial Expression Recognition
AI总结：
针对3D面部表情识别中传统点云对抗攻击易造成面部畸形的问题，本文提出ε-Mesh Attack，将扰动限制在网格表面并以ε缩放，以难以察觉的变形实现对DGCNN和PointNet的高成功率攻击。
摘要：
点云和网格是许多计算机视觉应用中广泛使用的3D数据结构。网格表示物体的表面，而点云表示从表面采样的点，这也是LiDAR和RGB-D相机等现代传感器的输出。由于点云的广泛应用领域以及深度神经网络的最新进展，出现了专注于3D点云数据鲁棒分类的研究。为了评估深度分类器网络的鲁棒性，一种常用方法是使用对抗攻击，即遵循梯度方向对输入进行轻微改变。以往关于对抗攻击的研究通常在日常物体的点云上进行评估。然而，就3D人脸而言，这些对抗攻击往往会对人的面部结构造成超出预期程度的影响，并导致畸形。特别是对于面部表情，即使是微小的对抗攻击也可能对面部结构产生显著影响。本文提出了一种名为ε-Mesh Attack的对抗攻击，它通过将扰动限制在网格表面上来对点云数据进行操作。我们还通过ε对攻击进行参数化，以缩放扰动网格。与在单位球上运行的L₂和L∞范数有界攻击相比，我们这种基于表面的攻击具有更紧的扰动边界。尽管我们的方法存在额外约束，但在CoMA、Bosphorus和FaceWarehouse数据集上的实验表明，ε-Mesh Attack（Perpendicular）能够以99.72%和97.06%的成功率成功迷惑经过训练的DGCNN和PointNet模型，且面部变形难以察觉。代码可在https://github.com/batuceng/e-mesh-attack获取。
英文摘要：
Point clouds and meshes are widely used 3D data structures for many computer vision applications. While the meshes represent the surfaces of an object, point cloud represents sampled points from the surface which is also the output of modern sensors such as LiDAR and RGB-D cameras. Due to the wide application area of point clouds and the recent advancements in deep neural networks, studies focusing on robust classification of the 3D point cloud data emerged. To evaluate the robustness of deep classifier networks, a common method is to use adversarial attacks where the gradient direction is followed to change the input slightly. The previous studies on adversarial attacks are generally evaluated on point clouds of daily objects. However, considering 3D faces, these adversarial attacks tend to affect the person's facial structure more than the desired amount and cause malformation. Specifically for facial expressions, even a small adversarial attack can have a significant effect on the face structure. In this paper, we suggest an adversarial attack called $ε$-Mesh Attack, which operates on point cloud data via limiting perturbations to be on the mesh surface. We also parameterize our attack by $ε$ to scale the perturbation mesh. Our surface-based attack has tighter perturbation bounds compared to $L_2$ and $L_\infty$ norm bounded attacks that operate on unit-ball. Even though our method has additional constraints, our experiments on CoMA, Bosphorus and FaceWarehouse datasets show that $ε$-Mesh Attack (Perpendicular) successfully confuses trained DGCNN and PointNet models $99.72\%$ and $97.06\%$ of the time, with indistinguishable facial deformations. The code is available at https://github.com/batuceng/e-mesh-attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
