Invisible Backdoor Attack against 3D Point Cloud by Optimized 3D Transformation

3D point cloud are widely used to represent 3D object in many security-crucial domains, such as self-driving and 3D face recognition. Due to the black-box characteristic of 3D point cloud deep neural network (3D DNN), many security concerns are raised. Backdoor attack mainly aims to destroy victim 3D DNN in the training stage by injecting backdoored training data. Recently, a few backdoor attacks for 3D point cloud are designed. Though they achieve promising attack success rate, the caused deformations are severe. We argue that this is because the existing backdoor attacks are too aggressive in order to achieve a higher attack success rate. Besides, another reason is that the methods to implant backdoor triggers are too limited, which causes deformation concentration. By addressing the above issues, we regard 3D transformations as the implanted backdoor trigger which include rotation, scaling, shearing and symmetry at the same time. Furthermore, in order to decide the optimal 3D transformation, we model the backdoor trigger selection process as an optimization problem which pursues high attack success rate and high stealthiness at the same time. Finally, a genetic algorithm is utilized to solve the modeled optimization problem. Extensive experiments suggest that the proposed backdoor attack achieves a competitive attack success rate and the best stealthiness.