HAMC: Hybrid Attacks With Multiple Constraints Against Point Cloud Classification

3D point cloud classification is an important task in autonomous driving for capturing the characteristics of a 2D manifold embedded in a 3D ambient space. Despite their excellent performance, existing 3D point cloud classifiers have been shown to be as vulnerable to adversarial examples as 2D models. However, current attack methods struggle to achieve a balance between adversarial effectiveness and imperceptibility, often resulting in either low attack success rates or significant outliers that are easily removed by statistical outlier removal. In this paper, we develop a ranking map to evaluate the representational capacity of the model for individual points and launch attacks by grouping key points into a critical point set. To ensure invariance to point cloud transformations, we propose a combined search-direction method instead of randomly selecting attack directions, thereby enhancing the robustness of the generated adversarial examples in the physical world. Additionally, we introduce a surrogate test target structure to improve the attack strength of adversarial point clouds. To enhance naturalness, we develop an adaptive multi-directional perturbation attack algorithm called HAMC (Hybrid Attacks with Multiple Constraints), in which different attack directions exhibit varying degrees of sensitivity to curvature. Experiments on typical point cloud classification models demonstrate that our method significantly improves the attack success rate and achieves a better balance between adversarial potency and invisibility compared to state-of-the-art attack methods.