# [Robust Adversarial Objects against Deep Learning Models](https://ojs.aaai.org/index.php/AAAI/article/view/544)
The authors propose a white box adversarial attack model on 3D pointcloud model.

### Proposed Method :

- The model performs pertubations on the pointcloud based Carlini and Wagner attack.
- The distance metric used in chamfer as pointcouds are unordered and unstructured.
- If perturbed point lie far during reconstruction they can easily be removed to tackle this kNN smoothing and pertubation clipping and projection is used.
- In kNN we make sure the points lie close and in PCP we clip the points inside the object and only outliers are taken.
- Since pointclouds are expected to be robust to random inputs we select points randomly in each optimisation step to model the pertubations.
- After the pertubations as pointcloud is shifted the reconstruction algorithm used is Screened Poisson Surface Reconstruction.

### Experiments :
- The metrics used is the chamfer distance between original and perturbed.
- The dataset used is ModelNet40.
- The evaluation is done as untargeted attack,most likely attack and random attack with random attack showing very different success rates among different classes.
- The reconstruction is done using two methods closest and random with random occasionally failing.

**Existing Defense Mechanisms:**
- The PointCloud++ has existing defense mechanisms which are random rotation,kNN outlier removal and adding random Gaussian Noise.
- Random rotations have very less effect on attacks about 10%.
- kNN smoothing takes ccare of outlier removal.
- Gaussian noise defense detects whether an example is adversarialor not which rejects 30-40% attacks in untargeted and most likely and upto 80% in random attack.