ML Security PapersLess Is More: Sparse and Cooperative Perturbation for Point Cloud Attacks
Keke Tang 1,2, Tianyu Hao 1,2, Xiaofei Wang 3, Weilong Peng 1, Denghui Zhang 1, Peican Zhu 3, Zhihong Tian 1,4
2 University of Science and Technology of China
3 Northwestern Polytechnical University
4 Guangdong Key Laboratory of Industrial Control System Security
Published on arXiv
2512.13119
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
SCP achieves 100% attack success rate on point cloud classifiers, surpassing state-of-the-art sparse attacks while requiring far fewer point modifications than dense attacks.
SCP (Sparse and Cooperative Perturbation)
Novel technique introduced
Most adversarial attacks on point clouds perturb a large number of points, causing widespread geometric changes and limiting applicability in real-world scenarios. While recent works explore sparse attacks by modifying only a few points, such approaches often struggle to maintain effectiveness due to the limited influence of individual perturbations. In this paper, we propose SCP, a sparse and cooperative perturbation framework that selects and leverages a compact subset of points whose joint perturbations produce amplified adversarial effects. Specifically, SCP identifies the subset where the misclassification loss is locally convex with respect to their joint perturbations, determined by checking the positivedefiniteness of the corresponding Hessian block. The selected subset is then optimized to generate high-impact adversarial examples with minimal modifications. Extensive experiments show that SCP achieves 100% attack success rates, surpassing state-of-the-art sparse attacks, and delivers superior imperceptibility to dense attacks with far fewer modifications.
Key Contributions
- SCP framework that selects a sparse subset of points whose joint perturbations are cooperative (locally convex misclassification loss) via Hessian block positive-definiteness checking
- Optimization of the selected cooperative subset to produce high-impact adversarial examples with minimal geometric modification
- Achieves 100% attack success rate on point cloud classifiers, outperforming state-of-the-art sparse attacks while improving imperceptibility over dense attacks
🛡️ Threat Analysis
SCP crafts adversarial perturbations on point cloud inputs to cause misclassification at inference time — a canonical input manipulation/adversarial example attack. The use of Hessian positive-definiteness to identify cooperative point subsets is a novel gradient-based perturbation optimization strategy.