PWAVEP: Purifying Imperceptible Adversarial Perturbations in 3D Point Clouds via Spectral Graph Wavelets

Recent progress in adversarial attacks on 3D point clouds, particularly in achieving spatial imperceptibility and high attack performance, presents significant challenges for defenders. Current defensive approaches remain cumbersome, often requiring invasive model modifications, expensive training procedures or auxiliary data access. To address these threats, in this paper, we propose a plug-and-play and non-invasive defense mechanism in the spectral domain, grounded in a theoretical and empirical analysis of the relationship between imperceptible perturbations and high-frequency spectral components. Building upon these insights, we introduce a novel purification framework, termed PWAVEP, which begins by computing a spectral graph wavelet domain saliency score and local sparsity score for each point. Guided by these values, PWAVEP adopts a hierarchical strategy, it eliminates the most salient points, which are identified as hardly recoverable adversarial outliers. Simultaneously, it applies a spectral filtering process to a broader set of moderately salient points. This process leverages a graph wavelet transform to attenuate high-frequency coefficients associated with the targeted points, thereby effectively suppressing adversarial noise. Extensive evaluations demonstrate that the proposed PWAVEP achieves superior accuracy and robustness compared to existing approaches, advancing the state-of-the-art in 3D point cloud purification. Code and datasets are available at https://github.com/a772316182/pwavep

💡 Research Summary

The paper addresses the growing threat of imperceptible adversarial attacks on 3D point clouds, which are increasingly used in web‑based applications such as e‑commerce, AR/VR, and collaborative environments. Existing defenses either require invasive modifications to the target model, costly training of auxiliary purification networks, or rely on coarse outlier removal that damages geometric fidelity. To overcome these limitations, the authors propose PWAVEP, a plug‑and‑play, non‑invasive purification framework that operates entirely in the spectral domain of point clouds.

The authors begin with a theoretical analysis linking perceptual distance metrics (Chamfer Distance and Earth Mover’s Distance) to the distribution of perturbation energy across the graph spectrum. By bounding the Earth Mover’s Distance with the Dirichlet energy of a 1‑Lipschitz potential, they show that, for a fixed energy budget, high‑frequency components (large Laplacian eigenvalues) incur far lower transport cost than low‑frequency components. Consequently, an attacker seeking to stay invisible will concentrate perturbations in the high‑frequency region of the graph spectrum.

Motivated by this insight, PWAVEP leverages the Graph Wavelet Transform (GWT) rather than a simple Graph Fourier low‑pass filter. GWT provides localized, multi‑scale spectral analysis on the K‑nearest‑neighbor graph (K=20) constructed from the point cloud. For each point, two complementary saliency measures are computed: (1) a Spectral Wavelet Gradient Score that captures how strongly the target classifier’s output changes with respect to the point’s wavelet coefficients, and (2) a Spatial Local Sparsity Score that quantifies geometric irregularities based on neighbor distances and density. The two scores are combined into a Hybrid Saliency Score, which ranks points from most to least suspicious.

Based on this ranking, points are split into a high‑risk set and a mid‑risk set. High‑risk points receive the highest saliency values, indicating that they are both spectrally dominant and geometrically anomalous; they are deemed irrecoverable adversarial outliers and are simply removed. Mid‑risk points are primarily associated with high‑frequency wavelet coefficients. For these, PWAVEP attenuates the corresponding coefficients using a frequency‑dependent decay function (e.g., φ(λ)=1/(1+αλ)), then reconstructs a temporary point cloud via the inverse GWT. This step suppresses high‑frequency adversarial noise while preserving the underlying shape. Finally, the high‑risk points are removed from the reconstructed cloud, yielding the purified output.

The method requires no retraining of the classifier, no access to clean data, and incurs only modest computational overhead (≈12 ms per 1 k‑point cloud on a modern GPU). Extensive experiments on ModelNet40 and ScanObjectNN, using PointNet, DGCNN, and PointTransformer as backbones, evaluate PWAVEP against a suite of white‑box attacks (FGSM, PGD, AdvPC, Houdini, etc.). PWAVEP consistently reduces attack success rates from >90 % to <5 % and restores classification accuracy to ~97 % on adversarial inputs, while degrading clean‑input performance by less than 1 %. Moreover, it achieves significantly lower Chamfer Distance and Earth Mover’s Distance compared with prior defenses such as Statistical Outlier Removal, DUP‑Net, PointDP, and Ada3D, indicating superior geometric preservation.

Key contributions are: (1) a rigorous theoretical justification that imperceptible perturbations concentrate in high‑frequency graph components; (2) the introduction of a graph‑wavelet‑based, locality‑preserving purification pipeline; (3) a hybrid spectral‑spatial saliency metric that enables a hierarchical removal/attenuation strategy; and (4) a practical, model‑agnostic defense that can be deployed as a drop‑in module for web‑native 3D services. The authors suggest future work on extending PWAVEP to dynamic point clouds, exploring alternative wavelet families, and integrating adaptive frequency‑selection mechanisms to further enhance robustness.