Generating Adversarial Events: A Motion-Aware Point Cloud Framework

Event cameras have been widely adopted in safety-critical domains such as autonomous driving, robotics, and human-computer interaction. A pressing challenge arises from the vulnerability of deep neural networks to adversarial examples, which poses a significant threat to the reliability of event-based systems. Nevertheless, research into adversarial attacks on events is scarce. This is primarily due to the non-differentiable nature of mainstream event representations, which hinders the extension of gradient-based attack methods. In this paper, we propose MA-ADV, a novel \textbf{M}otion-\textbf{A}ware \textbf{Adv}ersarial framework. To the best of our knowledge, this is the first work to generate adversarial events by leveraging point cloud representations. MA-ADV accounts for high-frequency noise in events and employs a diffusion-based approach to smooth perturbations, while fully leveraging the spatial and temporal relationships among events. Finally, MA-ADV identifies the minimal-cost perturbation through a combination of sample-wise Adam optimization, iterative refinement, and binary search. Extensive experimental results validate that MA-ADV ensures a 100% attack success rate with minimal perturbation cost, and also demonstrate enhanced robustness against defenses, underscoring the critical security challenges facing future event-based perception systems.

💡 Research Summary

The paper introduces MA‑ADV, a novel motion‑aware adversarial framework that generates adversarial event streams for event‑camera‑based perception systems by directly operating on raw events represented as 4‑dimensional point clouds (x, y, t, polarity). Traditional adversarial attacks on event data have been hampered by the non‑differentiable nature of frame‑based representations, which prevent gradient‑based optimization. By treating events as point clouds, the authors bypass this bottleneck and can back‑propagate gradients through state‑of‑the‑art point‑cloud networks such as PointNet++ and EventMamba.

The core technical contributions are threefold. First, a motion‑aware perturbation diffusion mechanism is proposed. For each event, spatial neighbors (I_s) and temporal causal neighbors (I_t) are identified using K‑Nearest Neighbor search that jointly considers spatial (x, y) and temporal (t) distances. A velocity term V, computed from successive events, captures local motion. Spatial and temporal diffusion weights are defined as exponential decays of distance (W_s = exp(−D/σ_s)) and velocity (W_t = exp(−V/σ_t)). The initial perturbation P₀ is then diffused across neighbors: P_i = P_i(I_s)·W_s + P_i(I_t)·W_t. This diffusion smooths high‑frequency sensor noise while preserving motion cues, stabilizing gradient updates.

Second, the authors introduce a sample‑wise learning‑rate adjustment. Instead of a uniform learning rate for an entire batch, each event stream receives an adaptive rate derived from its current classification loss and perturbation magnitude. The Adam optimizer is extended to incorporate this per‑sample rate, allowing heterogeneous streams (different event densities, motion speeds) to be optimized efficiently, improving attack success while keeping perturbations minimal.

Third, a binary‑search scheme dynamically tunes the trade‑off coefficient λ that balances classification loss (L_cls) and a distance loss (L_dist, e.g., Chamfer distance) in the total loss L_total = L_cls + λ·L_dist. By iteratively narrowing λ, the method finds the smallest perturbation that still forces misclassification, achieving a minimal‑cost attack.

Extensive experiments on three benchmark event datasets (N‑MNIST, DVS‑Gesture, N‑Caltech101) demonstrate a 100 % untargeted attack success rate. Compared with prior PGD‑based timestamp‑shift attacks, MA‑ADV reduces the L₂ perturbation norm by 30–45 %. Moreover, the attacks remain effective against several recent defenses (event filtering, temporal window regularization), indicating robustness. Computationally, KNN neighbor retrieval is GPU‑accelerated, processing 10⁵ events in roughly 30 ms, suggesting feasibility for real‑time scenarios.

The paper acknowledges limitations: it focuses on untargeted attacks, leaving targeted attacks as future work; KNN scaling may become a bottleneck for extremely dense streams, motivating approximate nearest‑neighbor or graph‑based diffusion alternatives; and physical‑world attacks (e.g., adversarial lighting) are not explored. Nonetheless, MA‑ADV establishes a new paradigm for gradient‑based adversarial attacks on event cameras, highlighting critical security vulnerabilities and providing a foundation for developing more robust event‑based perception systems.