Adversarial Learning and Secure AI

Backdoor attacks have been considered in non-image data domains, including speech and audio, text, as well as for regression applications (Chapter 12). In this chapter, we consider classification of point cloud data, for example, LiDAR data used by autonomous vehicles. Point cloud data differs significantly from images, with the former representing a given scene/object by a collection of points in 3D (or a higher-dimensional) space. Accordingly, point cloud DNN classifiers (such as PointNet) deviate significantly from the DNN architectures commonly used for image classification. So, backdoor (as well as test-time evasion) attacks also need to be customized to the nature of the (point cloud) data. Such attacks typically involve either adding points, deleting points, or modifying (transforming) the points representing a given scene/object. While test-time evasion attacks against point cloud classifiers were previously proposed, in this chapter we develop backdoor attacks against point cloud classifiers (based on insertion of points designed to defeat the classifier, as well as to defeat anomaly detectors that identify point outliers and remove them). We also devise a post-training detector designed to defeat this attack, as well as other point cloud backdoor attacks.