PWAVEP: Purifying Imperceptible Adversarial Perturbations in 3D Point Clouds via Spectral Graph Wavelets

AI summary

Overview

• Research area: Adversarial robustness and security for 3D point cloud deep learning, specifically defense methods grounded in spectral graph signal processing (graph wavelets). The paper is published at the ACM Web Conference 2026 (WWW '26), so it frames 3D point clouds as a component of Web-native 3D applications (immersive e-commerce, virtual try-ons, augmented reality, collaborative online environments).
• Technical level: Advanced. The paper relies on graph Laplacians, graph Fourier bases, spectral graph wavelet transforms, Chebyshev polynomial approximation, and Kantorovich–Rubinstein duality for an Earth Mover's Distance bound.
• Scope (one sentence): The paper proposes PWaveP, a training-free, plug-and-play purification module that removes imperceptible adversarial perturbations from 3D point clouds by attenuating high-frequency content in a graph wavelet domain while preserving point cloud geometry.

What This Paper Is About

Deep models that classify 3D point clouds can be fooled by adversarial attacks that shift points by tiny amounts, producing point clouds that look visually unchanged but are misclassified. The authors ask whether such noise can be removed without retraining the victim model, without touching the model's weights, and without access to any clean or auxiliary data. Their answer is PWaveP, a pre-processing purifier that exploits a theoretical claim: because attackers must keep perceptual distance (Chamfer Distance and Earth Mover's Distance) low, they naturally push perturbation energy into high-frequency components of the point cloud's KNN-graph spectrum, where that energy can be found and suppressed.

Key Contributions

1. A plug-and-play, non-invasive purification framework (PWaveP). It requires no modification of the target model, no training, and no clean or auxiliary datasets, and can be attached to any 3D point cloud recognition model. It combines a Graph Wavelet Transform with a hybrid saliency score and a hierarchical two-stage defense (filtering plus removal).
2. A theoretical analysis of why imperceptible perturbations live in high frequencies. Using Chamfer Distance (bounded by the Froben

Authors’ abstract

Recent progress in adversarial attacks on 3D point clouds, particularly in achieving spatial imperceptibility and high attack performance, presents significant challenges for defenders. Current defensive approaches remain cumbersome, often requiring invasive model modifications, expensive training procedures or auxiliary data access. To address these threats, in this paper, we propose a plug-and-play and non-invasive defense mechanism in the spectral domain, grounded in a theoretical and empirical analysis of the relationship between imperceptible perturbations and high-frequency spectral components. Building upon these insights, we introduce a novel purification framework, termed PWAVEP, which begins by computing a spectral graph wavelet domain saliency score and local sparsity score for each point. Guided by these values, PWAVEP adopts a hierarchical strategy, it eliminates the most salient points, which are identified as hardly recoverable adversarial outliers. Simultaneously, it applies a spectral filtering process to a broader set of moderately salient points. This process leverages a graph wavelet transform to attenuate high-frequency coefficients associated with the targeted points, thereby effectively suppressing adversarial noise. Extensive evaluations demonstrate that the proposed PWAVEP achieves superior accuracy and robustness compared to existing approaches, advancing the state-of-the-art in 3D point cloud purification. Code and datasets are available at https://github.com/a772316182/pwavep