NormalAttack: Curvature-Aware Shape Deformation along Normals for Imperceptible Point Cloud Attack

Table 4

Attack success rates and perturbation sizes of the full NormalAttack and the ones with the curvature-aware module (CM) and deformation guiding module (DGM) ablated.

Victim model	Attack method	Attack success rate (%)	Perturbation size
			-norm	HD	CD
PointNet++	Ours	97.58	0.5780	0.0050	0.0003
	Ours w/o CM	98.57	0.5882	0.0052	0.0003
	Ours w/o DGM	98.57	0.5781	0.0052	0.0003
DGCNN	Ours	86.59	0.9391	0.0089	0.0007
	Ours w/o CM	87.03	0 .9736	0.0090	0.0007
	Ours w/o DGM	88.02	0.9409	0.0090	0.0007
PointConv	Ours	94.06	0.8673	0.0085	0.0006
	Ours w/o CM	93.73	0.8850	0.0086	0.0006
	Ours w/o DGM	94.17	0.8680	0.0086	0.0006