MBA: Backdoor Attacks Against 3D Mesh Classifier

Citations Over TimeTop 10% of 2023 papers

Abstract

3D mesh classification deep neural network (3D DNN) has been widely applied in many safety-critical domains. Backdoor attack is a serious threat that occurs during the training stage. Previous backdoor attacks from 2D image and 3D point cloud domains are not suitable for 3D mesh due to data structure restrictions. Therefore, in a pioneering effort, this paper presents two types of backdoor attacks on 3D mesh. Specifically, the first attack is a Mesh Geometrical Feature guided 3D Mesh Backdoor Attack named MGF-MBA. Most 3D DNNs have to convert 3D mesh to a regular matrix (mesh geometrical feature), which is a refinement of the input 3D mesh. The 3D DNN directly learns the 3D shape from the mesh geometrical feature, which enables attackers to implant backdoor through it. Hence, the proposed MGF-MBA generates a backdoored 3D mesh under the guidance of mesh geometrical feature. The second attack is a Remeshing based 3D Mesh Backdoor Attack named ReMBA. The quality of samples backdoored by exiting backdoor attacks always decrease. Although many efforts have been made to reduce the descent in quality in return for stealthiness, the descent persists. For better stealthiness, we regard the backdoor implantation process as a way to increase the quality of backdoored sample rather than a way to reduce it. Specifically, ReMBA designs a new isotropic remeshing method that attempts to represent a 3D mesh by equilateral triangles while keeping the number of vertices, edges and faces unchanged. Numerous experimental results show that both MGF-MBA and ReMBA achieve guaranteed attack performance on 3D DNNs. Furthermore, transferability experiments demonstrate that ReMBA can even attack 3D point cloud networks with an increased ability to resist defenses.

Related Papers

• → Kallima: A Clean-Label Framework for Textual Backdoor Attacks(2022)21 cited
• → I Know Your Triggers: Defending Against Textual Backdoor Attacks with Benign Backdoor Augmentation(2022)1 cited
• → Rethinking the Trigger of Backdoor Attack(2020)98 cited
• → Test-Time Detection of Backdoor Triggers for Poisoned Deep Neural Networks(2021)1 cited
• Susquehanna Chorale Spring Concert "Roots and Wings"(2017)