{'fraction_non_alphanumeric': 0.028437959016590818, 'fraction_numerical': 0.013653109875027089, 'mean_word_length': 4.850119735173968, 'pattern_counts': {'":': 0, '<': 1, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 3, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
PointCA: Evaluating the Robustness of 3D Point Cloud Completion Models Against Adversarial Examples

Point cloud completion, as the upstream procedure of 3D recognition and segmentation, has become an essential part of many tasks such as navigation and scene understanding. While various point cloud completion models have demonstrated their powerful capabilities, their robustness against adversarial attacks, which have been proven to be fatally malicious towards deep neural networks, remains unknown. In addition, existing attack approaches towards point cloud classifiers cannot be applied to the completion models due to different output forms and attack purposes. In order to evaluate the robustness of the completion models, we propose PointCA, the first adversarial attack against 3D point cloud completion models. PointCA can generate adversarial point clouds that maintain high similarity with the original ones, while being completed as another object with totally different semantic information. Specifically, we minimize the representation discrepancy between the adversarial example and the target point set to jointly explore the adversarial point clouds in the geometry space and the feature space. Furthermore, to launch a stealthier attack, we innovatively employ the neighbourhood density information to tailor the perturbation constraint, leading to geometry-aware and distribution-adaptive modifications for each point. Extensive experiments against different premier point cloud completion networks show that PointCA can cause a performance degradation from 77.9% to 16.7%, with the structure chamfer distance kept below 0.01. We conclude that existing completion models are severely vulnerable to adversarial examples, and state-of-the-art defenses for point cloud classification will be partially invalid when applied to incomplete and uneven point cloud data.


Introduction
With the flourishing development of diverse 3D sensors like LiDAR, RADAR, and depth camera, point cloud data are utilized among many safety-critical fields such as autonomous driving, augmented reality, and robotics. Due to its great success in the computer vision area (He et al. 2016), deep learning techniques have been widely applied to point Figure 1: Geometric distribution of partial point cloud data for completion and complete point cloud data for classification. Partial point clouds have a significantly more complex and locally diverse geometric distribution. cloud tasks as well. Recent studies show that neural networks are vulnerable to adversarial attacks, where misclassifications can be easily triggered when facing adversarial examples (Goodfellow, Shlens, and Szegedy 2015;Hu et al. 2022a). Therefore, more and more research efforts are devoted to exploring the security and robustness of deep learning-based 3D point cloud systems.
Unfortunately, existing works only concentrate on the point cloud classification scenario, whereas point cloud completion, another important task for point cloud systems, has received no attention. The completion model is designed to restore the incomplete point cloud data induced by various real-world circumstances, such as limited sensor resolution, and thus it has become a necessary upstream procedure in point cloud processing.
As opposed to point cloud classification, adversarial attack of point cloud completion is more challenging since it requires the manipulation of the geometric shapes rather than the object labels. Specifically, the output of the completion model is an instantial point cloud with semantic and geometric shape, instead of a hard label that directly indicates which class the object belongs to. No classification score or cross-entropy loss can be exploited to generate an adversarial point cloud. In other words, the goal of adversarial attacks on the point cloud completion models is to generate a misleading geometric shape rather than a false class label, thus a totally different loss function is needed to measure the similarity between the adversarial example and the target. Secondly, point cloud classification generally generates adversarial examples over synthetic datasets (Wu et al. 2015), whose point clouds are complete and uniform with continuous geometric manifolds, whereas the incomplete partial point clouds in the completion tasks have a more realistic and uneven geometric distribution caused by the occlusion and limited sensor viewing angle. To verify this, Fig. 1 visualizes the difference in geometric distributions of the input point clouds from two tasks, assigning a score to each point depending on the density of its surrounding region through Eq. (10). The data distribution is more fluctuating and inconsistent in partial point clouds. How to efficiently and stealthily generate adversarial examples on more nonuniformly distributed data is a challenging problem that has been ignored by previous works in the classification, but is crucial for point cloud completion attacks.
In this paper, we propose PointCA, the first adversarial attack on 3D point cloud completion models to systematically evaluate their robustness. As shown in Fig. 2, the adversarial example generated by PointCA is visually similar to the original one, but completed as another target object with totally different semantic information. To overcome the above challenges, PointCA first explores the similarity measurement in the geometry space and the feature space respectively, formulating the adversarial example generation as an appropriate optimization problem which can be solved by the gradient-based algorithm. In addition, considering the unevenness and incompleteness of the partial point cloud data, we define and allocate local geometric neighborhood for each input point through the k-Nearest Neighbor (kNN) algorithm and evaluate the distribution density in the neighbor point sets, based on which the perturbation constraint will be adaptively tailored for each point to achieve a more imperceptible and efficient attack.
To summarize, the contributions of our work are as follows: • We propose PointCA, the first adversarial attack on 3D point cloud completion models. By investigating the characteristics of the geometry space and the feature space, an appropriate optimization problem is formulated to measure the similarity between geometric shapes and find adversarial examples.
• We innovatively employ the neighborhood density information to tailor a perturbation constraint and design the geometry-aware and distribution-adaptive modification for each point to achieve a stealthy attack under the locally diverse geometric distribution of partial point clouds.
• Our experiments show that PointCA can cause at least 60% performance degradation over different completion models, while keeping a low perceptibility of adversarial perturbations. We verify that the state-of-the-art defense methods based on statistic outlier removal cannot fully guard the point cloud completion model.

Attacks on Point Cloud Classification
In the point cloud domain, Xiang et al. (2019) proposed the first point cloud attack algorithm based on the C&W framework (Carlini and Wagner 2017). Hamdi et al. (2020) then employed an autoencoder loss to strengthen the transferability of the attack across multiple classification models. To reduce the perceptibility of adversarial point clouds, Kim et al. (2021) and Shi et al. (2022) explored perturbing only a minimal number of points and preserving the original geometric shape as much as possible.
LG-GAN was introduced by Zhou et al. (2020) for a more efficient and flexible point cloud attack. Although widely studied in the literature, existing adversarial attacks focus on point cloud classification tasks, which mainly concentrate on the artificial data in virtual scenarios and ignore many realistic properties of point clouds such as nonuniform distribution and structure damage (Sun et al. 2022;Ren, Pan, and Liu 2022), making them difficult to apply to point completion tasks.

Attacks on Point Cloud Generation
Attacks on generative models have also received attention (Kos, Fischer, and Song 2018;Willetts et al. 2021). GeoAdv (Lang, Kotlicki, and Avidan 2021) first launched the attack against point cloud reconstruction model based on autoencoder structure. However, our work is significantly different from it. Compared with reconstruction, point cloud completion is a much more different and difficult task. The completion model is not explicitly enforced to retain the input in its output like an autoencoder. Instead, it needs to infer the complete structure from the partial observation with less prior knowledge. Besides, the higher data complexity in point cloud completion induces a higher standard of perturbation constraint (Fig. 1). In order to prevent excessive perturbations that do not match the local geometry manifolds and easily recognizable attacks, we create the Adaptive Geometric Constraint for each point rather than employing a globally consistent constraint threshold.

Defenses on Point Clouds
Disparate methods have been developed to defend against adversarial attacks for point cloud classification. Among existing defenses including adversarial training, Gaussian noise perturbation (Yang et al. 2019), certified robustness (Liu, Jia, and Gong 2021), and point removal (Liu, Yu, and Su 2019), the statistical outlier removal (SOR) (Zhou et al. 2019) achieves the best performance due to its effectiveness and efficiency. Based on the fact that perturbed points in attacks are likely to become outliers off the manifold of the point cloud surface, SOR can remove adversarial  Figure 2: An illustration of targeted attack results. Source is the partial point cloud generated on Ground Truth from one view point. Tiny perturbations are added to Source to obtain the Adversary, whose completion Output is very close to the target.
points in a statistical manner. As shown in our experiments (Table 3), although SOR performs well in the classification task, it fails to fully guarantee robustness when facing incomplete partial point clouds.

Methodology Problem Formulation
Point cloud (PC) completion models aim to predict the complete structure of a given incomplete input. Generally, a well-trained PC completion model can provide a one-way geometric mapping: X P ∈ R m×3 → X ∈ R n×3 , where X P represents a partial point cloud, usually captured by the 3D sensor from a single observation angle of a real object. X is the ground-truth point cloud of X P , which can be considered as the point set uniformly scanned from the whole surface of the same original object associated with X P . An effective PC completion model f θ should satisfy: where d(S 1 , S 2 ) represents an appropriate metric that measures the discrepancy between two point clouds, γ is the evaluating threshold with a small value.
In this paper, we propose PointCA, the first adversarial attack towards point cloud completion models. The goal of PointCA is to delicately construct an adversarial version of X P , denoted as X P , which can lead to a false completion result from the PC completion model f θ . Formally, we have: where Y is the target point cloud from a different category.
According to the knowledge we know about the representations of the source and target point clouds, PointCA will be investigated in the geometry space and the latent space, respectively. Here, we denote them as Geometry PointCA and Latent PointCA.

Geometry PointCA
A straightforward solution for solving Eq. (2) is the bruteforce search for X P , which is apparently infeasible in prac-tice. We thus reformulate the problem as a rational optimization instance that can be efficiently solved by existing optimization algorithms. We denote the adversarial perturbation added to the original partial input as δ = X P − X P . Therefore Eq. (2) can be formulated as: where · p is a distance metric to measure the perceptibility of adversarial perturbation. Normally, · p is instantiated as In Geometry PointCA, we assume that the adversary knows the exact ground-truth of the target point cloud. As most PC completion networks are built on the encoderdecoder structure (Yang et al. 2018;Yuan et al. 2018;Xie et al. 2020;Zhang, Yan, and Xiao 2020), the model f θ can be formulated as: f θ (·) = De(En(·)). Therefore the optimized similarity loss based on geometry information can be defined as: where En is the encoder of the completion model, De is the decoder part, Y is the target complete point cloud. D chamf er represents the Chamfer distance metric.
In summary, the adversarial perturbations in Geometry PointCA are generated according to the Chamfer distance between the output completed geometry structures of the adversarial examples and the target point clouds. More details on point cloud distance metrics are attached in the supplementary.

Latent PointCA
In some strict scenarios, the point clouds of real-world objects suffer from diverse corruptions (Sun et al. 2022), where we cannot obtain complete and detailed ground-truth samples (Yu et al. 2021). It is necessary to further explore how to generate adversarial examples that get rid of the knowledge of the target complete point cloud data. Hence we propose the Latent PointCA where the adversary only obtains the partial target point cloud.
Inspired by variational autoencoder attacks and the latent variable model (Kos, Fischer, and Song 2018), inputs whose distribution are similar to each other in the representation of the latent layer will also get similar outputs with a high probability (Hu et al. 2022b). Instead of using the target point data straightly in Eq. (4), we leverage the similarity metric in the feature space and regard the learned latent feature vector as an approximate representation of the shape manifold. To launch this latent-based attack, we combine Euclidean distance (Kos, Fischer, and Song 2018) and Distribution distance (Willetts et al. 2021) to measure the difference between features and reformulate the optimized similarity loss as: where Y P is the partial point cloud in the target category different from X P , 2 -norm · 2 and Kullback-Leibler divergence D KL (· ·) are jointly used as the similarity metric between the features of inputs, λ is the hyperparameter.

Adaptive Geometric Constraint
Note that the optimation formula in Eq.
(3) has an important perturbation constraint: δ p . It is obvious that a smaller perturbation metric δ p leads to a stealthier attack. In this paper, we design a new method to provide adaptive constraints for PointCA to further improve the imperceptibility of adversarial point clouds and the attack efficiency. Here we first describe the intuition behind the adaptive constraint and then give the detailed algorithm. Intuition. For traditional 2D images, adversarial attacks usually use ∞ -norm to limit the variation degree on each channel, which clips the redundant perturbation to limit the maximum value as: δ ∞ ≤ . Similarly, Hamdi et al. (2020) and Liu et al. (2019) inherit this strategy to limit the perturbation on each 3D coordinate in point cloud adversarial attack as: where i is the sequence number of the point x i with the size of m, j is the coordinate parameter corresponding to one element of (x, y, z). Due to the highly structured property of point clouds, JGBA (Ma et al. 2020) considered the spatial geometry and designed a pointwise limitation to clip the perturbation amplitude in the Euclidean space: δ i 2 ≤ . Nevertheless, these works still treat all the points equally with the same restricting threshold. According to recent studies (Sun et al. 2021) and our experiments shown in Fig. 5, the distributions of points at different portions are distinct, not all points are equally essential in the optimization for the construction of an adversarial point cloud. The same limitation could be excessively strict for certain points while being insufficient for others. Additionally, after applying too much perturbation, points in uniformly and tightly dispersed areas are more likely to produce outliers that do not match the local geometry, lowering the imperceptibility of adversarial point clouds (Zhou et al. 2019).
: The illustration of local neighborhood geometry. For ease of presentation, we simply partition the points into two categories according to each point's score ρ. Points whose score ρ is below a threshold T are marked in yellow, otherwise marked in purple. The purple centroid point x j has a sparse local neighborhood, and the yellow centroid point x i is located in a dense local neighbor points set.
In light of this, instead of treating each independent point identically, we explore the local geometric relationship of points to tailor adversarial examples on partial point clouds. Local geometric density. To give a more precise analysis of the geometric structure, we partition the local neighborhood set for each point through kNN algorithm. Let S(x i , k) denote the local kNN point set of point x i in partial point cloud X P . The pairwise distance d i,l between the set centroid point x i and its local neighbor point x l is defined as: We measure the distribution sparsity of different local point sets S(x i , k) by calculating the average pairwise distance: Meanwhile, we evaluate the distribution uniformity of the local point set S(x i , k) by the standard deviation of d i,l : These two metrics together constitute a description score ρ about the local point cloud density for each point: where t is an auxiliary parameter that further refines the constraint with local uniformity information. Fig. 3 gives a brief illustration for the local geometry density. Adaptive constraint. Based on the above analysis of local geometric density, we can jointly exploit the sparsity and uniformity to customize an adaptive geometric perturbation threshold i independently for each point: where η is a scaling coefficient to set a flexible perturbation limitation. As a result, the adaptive geometric constraint

Algorithm 1: Point Cloud Completion Attack
Input: Model f θ ; benign partial PC X P ; target partial PC Y P or target complete PC Y. Parameter: Iterations n; nearest neighbor range k; step size β. Output: Completion adversarial example X P . 1 Initialize X P with random noise δ. 2 Obtain the local neighbor point set S(x i , k) that each point x i in X P has by kNN; 3 Compute the geometric adaptive restraint i for each point x i through Eq. (11); 4 for q = 1 to n do Compute the gradient ∆ = ∇ X P d similarity ; 10 Update the point cloud as Compute the overall perturbation δ ← X P − X P ;

12
For each point in X P : Update the point cloud as X P ← X P + δ ; 16 Return Adversarial partial point cloud X P .
will attach a larger perturbation to points which originally have a sparse distribution, and the points with a denser local neighborhood will be perturbed slightly. Thus the adversarial point cloud can maintain a similar distribution and fit the surface manifold of the clean partial point cloud better.
Finally, combining with the adaptive geometric constraint, Geometry PointCA is reformulated as: and Latent PointCA is reformulated as: arg min Note that we use an iterative gradient-based strategy to minimize these two similarity losses and update the perturbation δ. A complete description of our point cloud completion attack is shown in Algorithm 1.

Experiments Experimental Setup
Dataset and victim completion models. According to prevailing methods (Xie et al. 2021;Wang et al. 2021), we employ the back-projected depth camera (Yuan et al. 2018) to create partial point clouds on Modelnet10 (Wu et al. 2015) because of the dataset's excellent versatility in various point cloud tasks. Four well-trained point cloud completion models: PCN (Yuan et al. 2018), RFA (Zhang et al.2020), GR-Net (Xie et al. 2020), and VRCNet ) are the target models of our attacks. More detailed dataset setting, model training parameters, and completion evaluations appear in our supplementary. Evaluation metrics. PointCA aims to alter the model's output to a target geometric shape. In order to evaluate the attack performance, we thus use target reconstruction error T-RE = d(f θ (X P ), Y) to measure the similarity between outputs and targets, where d(·) indicates chamfer distance (CD) or earth mover's distance (EMD) (Rubner, Tomasi, and Guibas 2000). Considering the completion models usually have an inherent error, we also investigate the relative attack effect through target normalized reconstruction error (Lang, Manor, and Avidan 2020) as: If T-NRE = 1, the attack effect of the adversarial point cloud can be roughly equated to that of the target object's original partial point cloud.
Besides, the perturbation budget d(X P , X P ) and outliers number under SOR algorithm (Zhou et al. 2019) are calculated to further evaluate the stealthiness of our method.
For defense countermeasure assessments on our adversarial point clouds, we exploit the source reconstruction error S-RE = d(f θ (X P ), X) and source normalized reconstruction error (Lang, Kotlicki, and Avidan 2021): Attack Performance Implementation details. Different from the object-to-label attack in the classification, the adversarial attack in point cloud completion is object-to-object. One target class may include many different attacking objects for each source example, which results in an enormous expense. Similar to previous research (Lang, Kotlicki, and Avidan 2021), for each object class, we randomly select 20 point cloud pairs in the test set as source examples and each source pair will attack the other 9 object classes. For a given source pair and target label, we take 5 pairs from the target class whose ground truths are top-5 geometric neighbors nearest with source's in terms of Chamfer distance. To sum up, there are 20×10×9×5=9000 source-target pairs in PointCA. All the evaluation metrics are calculated on the average of these 9000 attacks.
Baselines. Random noise: We add random Gaussian noise to the input partial point clouds and investigate the outputs to exclude the interference of general noise. Classification noise: We also verify whether the adversarial noises created on classifiers can be transferred to attack point cloud completion models. More attack and baseline setting details are reported in our supplementary.
Analysis. The detailed attack results are exhibited in Table 1. Firstly, the low results under three scaling coefficients   η imply a satisfactory attack performance of our geometry attack and latent attack against all four completion models. The overall attack performance of geometry PointCA is even close to the completion effect of the original clean samples. Secondly, the high T-NRE of random noise shows that general noises cannot easily disturb the completion procedure towards targets. Thirdly, the adversarial perturbation created on classification model is useless when attacking completion models. Because the purpose of classification adversarial attack is merely to change the output's label, in most cases, the adversarial point clouds still resemble the original structures, making it impossible for them to successfully deceive other point cloud processing missions.
Relative attack success rate. Geometric distance metrics can be employed to measure the attack effectiveness of adversarial examples. Nevertheless, there is no precise definition of attack success rate (ASR) in our point cloud completion attacks. Therefore, we leverage T-NRE as a reference to dynamically assess the relative attack success rate (Relative-ASR). We set a success threshold τ , if one attack's T-NRE is below this threshold, we can roughly consider the attack is successful. Then the overall Relative-ASR can be calculated on these 9000 source-target pairs.
The results of Relative-ASR on PCN and RFA are depicted in Fig. 4. We can see there is a great gap between our attacks and baselines, which obviously demonstrates the strong attack ability further proving our attack's effectiveness. Semantic evaluation. We train three classifiers: PointNet, PointNet++, and DGCNN, with modelnet10 dataset. Subsequently, the complete point clouds reconstructed on our adversarial examples are fed into these models to obtain the classification results. In this way, we can comprehensively evaluate our attack methods in a point cloud processing pipeline rather than on an immutable independent model. As shown in Table 2, the Accuracy (ACC) of all the three classifiers decreases drastically, e.g., PointNet++ suffers from the decrease from 77.9% to 16.7%. It suggests that the completion outputs of partial adversarial point clouds have changed into other shapes with semantics different from the original ones. The Attack Success Rate (ASR) of latent attack is higher, indicating the feature similarity might be more effectively transmitted by the decoder and has a greater influence on downstream tasks than geometry similarity. Besides, the average ASR of all reconstructed point clouds is about 32%. Although only a part of the outputs  Figure 6: Visualization results of different perturbation constraint strategies. Our adaptive geometric constraint can obtain a better adversarial completion performance with less perturbation budget.
mislead the classification models to target labels, most of them cannot be identified as original semantics.

Comparison Study
Implementation details. In this section, we compare our adaptive geometric constraint with two popular perturbation constraint strategies in classification attacks: channelwise l ∞ -norm clip (Hamdi et al. 2020) and pointwise l 2 -norm clip (Ma et al. 2020), whose basic ideas of constraining the perturbation through clipping method are similar to ours. To ensure a fair comparison, we use perturbation budget and outliers number to analyze the adaptive constraint.
Analysis. The results on PCN and RFA are shown in Fig. 5.
Notably, compared with channelwise l ∞ -norm and pointwise l 2 -norm constraints, our method has an obvious advantage in generating a high quality of adversarial examples, i.e., a better T-NRE and fewer outliers under the same perturbation budget. It also verifies our insight that not all Defense None SRS OR SOR  points contribute equally to the final attack performance. The nonuniform and locally diverse data distributions of partial point clouds lead to an anisotropic search process in generating adversarial examples, thus an adaptive geometric constraint strategy is necessary in point cloud completion attack. Although channelwise l ∞ -norm and pointwise l 2 -norm constraints incur more perturbation budget, they are unable to take full advantage of the budget since some perturbations are useless for boosting an effective attack. Fig. 6 visualizes the examples generated under three perturbation constraints for comparison.

Evaluation against Defenses
Implementation details. We analyze the adversarial point clouds generated by Geometry PointCA under three mainstream defenses: Simple Random Sampling (SRS), Outlier Removal (OR), and Statistic Outlier Removal (SOR) Shi et al. 2022).
Analysis. The results in Table 3 show that although adversarial attacks can be somewhat mitigated, these defenses cannot fully recover the original shapes. SOR defense achieves a relatively good result, while in most cases, the reconstructed results of SOR denoised adversarial point clouds still have at least 50% errors compared with normally restored samples. More results under diverse defense settings are depicted in our supplementary.

Conclusion
In this paper, we propose the first adversarial attack towards point cloud completion model, namely PointCA. The representation similarity in the geometry space and the latent space is exploited to generate adversarial point clouds. We further design an adaptive geometric constraint depending on local density information for each point to improve the imperceptibility of PointCA. The comprehensive experiments verify the effectiveness and efficiency of our attack. On the other hand, EMD is more discriminative to the local details and density distribution (Wu et al. 2021). Chamfer distance. Based on two point cloud sets: S 1 and S 2 , the algorithm of CD finds the nearest neighbor point set for each point and sums the squared distances up, which is depicted as: Note that S 1 and S 2 do not need to have the same size to calculate CD. There are two variants for CD which are denoted as CD-P and CD-T (Wang, Ang Jr, and Lee 2020). Specifically, CD-P takes the square root operation and is divided by 2. Considering that point cloud coordinates are usually normalized to [−1, 1] or a unit sphere for computational convenience, the calculated result of CD-P is usually larger than the value of CD-T under the same point cloud pair.
In order to maintain consistent with previous work such as PCN (Yuan et al. 2018), all the Chamfer Distance metrics are measured through the CD-P method in our work. Although the specific values of the perturbation budget, target reconstruction error (T-RE) and target normalized reconstruction error (T-NRE) can be further reduced if computed by CD-T method, which seems to benefit us. However, we think the difference between two Chamfer Distance variants does not influence the correctness of the current results. Earth mover's distance. The EMD between point cloud sets S 1 and S 2 is formulated as: D earth mover s (S 1 , S 2 ) = min φ : S1→S2 where φ represents a bijection φ : S 1 → S 2 , which minimizes the average distance between corresponding points.

A.2 Dataset Generation
We use the back-projected depth camera (Yuan et al. 2018) to generate 10 partial point clouds of 1024 points from 10 random viewpoints on each complete object, and set the number of ground truth point clouds to be 16384. thus the completion dataset totally contains 33910 point cloud pairs for the training and 9080 point cloud pairs for the testing. Despite the fact that there are a few real-world reconstruction datasets (Dai et al. 2017), their ground truths contain missing regions and are not detailed enough to be used in completion tasks since the scanner's view is limited (Yuan et al. 2018;Yu et al. 2021).

A.3 Training of Victim Completion Models
Because of the distinction between our completion Model-net10 and other point cloud completion datasets, some custom modifications are necessary to the parameters of the completion model structures so that the completion models can be fully trained. PCN. The chamfer version of PCN (PCN-CD) is selected as our victim model. We follow the same settings in ) to train the model for 50 epochs with a batch size of 32. The fine loss of victim PCN on the test set is 0.01256 calculated in CD-P method.
RFA. The size of the input partial point cloud in our completion Modelnet10 is 1024, so the number of coarse point clouds is set to 1024. And the grid size and upratio are both set as 4, thus leading to an output fine point cloud whose size is 1024 × 4 2 = 16384, which is consistent with the size of ground truth. We train the RFA model with the default parameters in the original work. The fine loss of victim RFA on the test set is 0.01091 calculated in the CD-P method and 5 × 10 −4 when computed in the CD-T method.
GRNet. We change the sizes of both random point sampling and latent feature vector to 1024 to fit the input size of our partial point cloud. The GRNet model has been trained for 350 epochs with the base learning rate of 3 × 10 −4 . The fine loss of victim GRNet is 5.99 × 10 −4 , which is competitive with the results in official paper. Note that the official releasing code of GRNet implements the CD-T method, so its value may seem smaller. Whereas we compute the Chamfer Distance in attacks through the CD-P method for consistency across multiple victim models.
VRCNet. The VRCNet model has been trained according to the author's default settings and the number of input point cloud is set as 1024. Evaluated on the test set, the CD-P loss of victim VRCNet is 0.01055, the CD-T loss is 5.54 × 10 −4 and the F-Score is 0.6749. Given that the partial point clouds in our dataset only contain half as many points as the official MVP dataset, the model's fundamental performance is adequate to show the validity of our attack strategy.

A.4 Baseline Implementation Details
Random noise: We add random Gaussian noise to the input partial point clouds with a standard deviation of 0.02. Classification noise: Firstly, we train a Pointnet++ classification model on the partial point cloud dataset of Model-net10, then employ the method in (Xiang, Qi, and Li 2019) to generate the adversarial examples on classification model, whose attack success rate can reach nearly 100%. These adversarial examples produced on PointNet++ are subsequently fed to the completion models and get the evaluation results.
All these baseline noises are generated under the same local geometric density adaptive constraints with our geometry and latent attack.

A.5 Attack Implementation Details
A gradient-based algorithm is employed to construct perturbative point data such that the similarity loss in different representation spaces can be minimized between the adversarial point cloud and the target point set. We also implement a variable step size strategy. The specific parameter settings are depicted in Table 4. Geometry/Latent represents the parameters under the Geometry PointCA and Latent PointCA respectively.   of total points that are arbitrarily lost is determined by the Drop rate (Zhou et al. 2019).
Outlier Removal. Relocating outlying points that may be produced as a result of adversarial perturbations is another method defending against adversarial attacks. The mean euclidean pointwise distance d i = 1 l l j=1 d i,j between each central point and its k-Nearest Neighbors (kNN) points is used to identify outliers (Liu, Yu, and Su 2019). Extremely high mean distance points who exceed the setting Threshold are thought to be outliers and eliminated. This method makes the assumption that any outlier point must be the product of adversarial perturbations because each point on a natural shape should be consistently sampled along the surface. Statistic Outlier Removal. Statistic Outlier Removal method also leverages kNN to compute the average pairwise distance for each point, however the mean µ = 1 m m i=1 d i and the standard deviation σ = 1 m m i=1 (d i − µ) 2 of all these distances are combined to determine a filter threshold as µ + α · σ to trim the input, where α serves as an interval hyperparameter, so the denoised adversarial point cloud can be defined as X P sor = {x i |d i < µ + α · σ}. The number of outliers can be calculated by the difference in the size of point clouds before and after denoised (Zhou et al. 2019).
According to the efforts of the past Shi et al. 2022;Zhou et al. 2019), we set the Drop rate as 0.3 in SRS, the Threshold as 0.05 in OR ,the interval hyperparameter α as 1.1 and the defense neighborhood size K of kNN as 2 in our main paper.

B.1 Additional Relative-ASR Evaluation
Implementation details. We leverage T-NRE as a reference to dynamically assess the relative attack success rate (Relative-ASR). If one attack's T-NRE is below this threshold τ , we can roughly judge the attack is successful. Analysis. The Relative-ASR results evaluated on GRNet and VRCNet are depicted in Fig. 8. We can observe that the outcomes of our attack methods continue to substantially exceed the baselines on both models, demonstrating the power and applicability of our PointCA.

B.2 Additional Comparison Study
Implementation details. Apart from the PCN and RFA in the main paper, we also compare our adaptive geometric (d) Outliers on VRCNet Figure 9: Comparison between different perturbation constraint strategies on GRNet and VRCNet constraint with two popular perturbation constraint strategies on GRNet and VRCNet for a comprehensive research. Analysis. The results are shown in Fig. 9. The evaluating results on GRNet and VRCNet are consistent with the results on other two models. Compared with channelwise l ∞norm and pointwise l 2 -norm constraints, our method obtains a better T-NRE and fewer outliers under the same perturbation budget, which further confirms the correctness of our design.

B.3 Additional Evaluations against Defenses
Implementation details. We investigate the Geometry PointCA-generated adversarial point clouds with three widely used defenses: Simple Random Sampling (SRS), Outlier Removal (OR) and Statistic Outlier Removal (SOR).
To evaluate the performance of our method against defenses in a more comprehensive and detailed manner, we conduct trials on different attack parameters under various defense settings.
Analysis. Fig. 13 shows the results under different Drop rate settings in SRS defense. Fig. 14 shows the results under different Threshold in OR defense. Fig. 15 and Fig. 16 report the results under different defense neighborhood size K and different interval parameter α in SOR. We can observe that the SOR approach achieves the best outcome, whereas the SRS method has the weakest defense performance. Despite being tested with various defense configurations, our approach still results in incredibly large error for the majority of models, demonstrating the dependability of our approach.

B.5 Ablation Study on Neighborhood Size
Implementation details. Our adaptive perturbation constraint is based on the local neighborhood partition, so the neighborhood size k plays a key role for the proposed attack. For the sake of clarifying the internal mechanism of the design, we explore four kinds of neighborhood size k with three scaling coefficients η on PCN and RFA. Analysis. In Fig. 11, we find that the attack performance can be improved through expanding the size of the neighborhood points set, which is apparent under the settings of k = {2, 4, 8}. Whereas, the benefit of using the larger neighborhood seems slow down when setting the size as k = 16. It shows that the local neighborhood point sets of 8 points are sufficient to explore the local geometric distribution information on the partial point clouds. Therefore, we select the setting of k=8 in our experiments to obtain a balance between the computational efficiency and attack quality.   sparsity d i and distribution uniformity σ i : We use an auxiliary parameter t in our adaptive perturbation constraint to balance them. The auxiliary parameter t is empirically set to 3 in all attacks in the main paper. In Fig. 12, We show two cases of sparsity versus uniformity.
The point cloud local neighborhood may have the same sparsity but different uniformity. Conversely, the local neighborhoods of a point cloud may be homogeneous but sparse in distinct ways. To explore the specific relative contribution in our adaptive geometric constraint i of these two metrics, we evaluate the attack performance under different auxiliary parameters t.
(a) di = dj, σi = σj Analysis. We can find in Table 5 that uniformity information can slightly revise the generation process of adversarial point clouds. Nevertheless, it is less important than the sparsity information when increasing the scaling coefficient η.

B.7 Ablation Study on Latent Similarity Loss
Implementation details. The attack effect of Latent PointCA greatly depends on how effectively we can compare two sets of features in the hidden layer space. Considering prior work, we select the 2 -norm · 2 (Kos, Fischer, and Song 2018) and Kullback-Leibler divergence D KL (· ·) (Willetts et al. 2021) as our latent similarity metric losses. We investigate the attack performances under the different metrics with the consistent learning rate setting to choose the most effective strategy and enhance the effect our Latent PointCA. Analysis. Table 6 shows the results of different component combinations. It is observed that both KL divergence D KL (· ·) and 2 -norm · 2 can get the satisfactory results. However, due to the great variance in the magnitude of the hidden layer features of different models, the adjustment of parameters such as learning rate is more complicated and difficult. To reduce the influence of magnitude disparities from the standpoint of distribution similarity, we try to jointly use these two metrics. The best performance is obtained when they are combined, implying that the two components contribute to the improvement of the feature similarity measure in a complimentary way.  Table 6: T-NRE for our Latent PointCA with different similarity metrics. A smaller value means a better attack effect. ' ' indicates that the component is used.

C More Visualization Results
More visualization results of targeted attacks on RFA, GR-Net and VRCNet are exhibited in Fig. 17. (c) K=10 Figure 15: Comparison against the SOR defense. The defense neighborhood size K varies from 2 to 10 from left to right, and scaling coefficients η varies from 1 to 5 along x-axis in each sub-figure. (c) α=1.5 Figure 16: Comparison against the SOR defense. The defense interval parameter α varies from 0.7 to 1.5 from left to right, and scaling coefficients η varies from 1 to 5 along x-axis in each sub-figure.  Figure 17: More visualization results of targeted attacks on RFA, GRNet and VRCNet. Source is the partial point cloud generated on Ground Truth from one view point. Tiny perturbations are added to Source to obtain the Adversary, whose completion Output is very close to the target.