Skip to content

title: >- [Paper Note] HHA: Hierarchical Hyperbolic Constraints for Imperceptible Point Cloud Attacks description: >- [ECCV 2026][3D Vision][Adversarial Attack] Leverages Poincaré hyperbolic space with negative curvature to regularize geometric and semantic hierarchical substructures, generating adversarial point clouds with near-100% attack success rate and state-of-the-art imperceptibility. tags: - ECCV 2026 - 3D Vision - Adversarial Attack - Point Clouds - Hyperbolic Space date: 2026-09-19 content_hash: 3aa85208062c1430

HHA: Hierarchical Hyperbolic Constraints for Imperceptible Point Cloud Attacks

Conference: ECCV 2026
Paper: ECCV Official
Cached Source: /Users/zy/workspace/paper_cache/ECCV2026/eccv-4287.txt
Area: 3D Vision
Keywords: Adversarial Attack, Point Clouds, Hyperbolic Space, Poincaré Ball, Hierarchical Decomposition

TL;DR

HHA decomposes 3D point clouds into dual geometric and semantic hierarchies and embeds them into Poincaré hyperbolic space, applying level-wise hyperbolic Chamfer constraints to preserve multi-scale structure and achieve state-of-the-art imperceptibility while maintaining near-100% attack success rates.

Background & Motivation

Deep neural networks deployed on 3D point clouds have become foundational for safety-critical tasks such as autonomous navigation, robotic grasping, and spatial computing. However, point cloud classifiers remain remarkably fragile under adversarial attacks: injecting minute, well-crafted coordinate perturbations into a clean point cloud readily induces severe misclassification. To prevent perturbations from being visually obvious or filtered out by simple geometry detectors, prior attacks enforce imperceptibility constraints largely within Euclidean space, relying on global distance norms (e.g., \(\ell_2\), Chamfer distance, Hausdorff distance), surface curvature alignment, normal-guided directions, or locally parameterized tangent manifolds.

Despite these efforts, 3D objects inherently feature a multi-scale, tree-structured organization spanning coarse functional parts down to fine-grained geometric regions. Conventional Euclidean metrics operate in flat geometry with polynomial volume growth, inherently struggling to represent tree-like structural expansions without substantial metric distortion. As a result, Euclidean-constrained optimizations frequently disrupt part-level relationships and cross-scale dependencies, leading to visually noticeable surface irregularities, isolated outlier spikes, or structural shear across components.

Hyperbolic geometry, characterized by constant negative curvature and exponential representational volume, offers an ideal metric space to embed hierarchical topologies with minimal distortion. The core idea of this paper is to decompose the point cloud into dual geometric and semantic hierarchies and embed these substructures into Poincaré hyperbolic space, enforcing localized geodesic constraints that guide perturbations to strictly adhere to the shape's intrinsic multi-scale organization.

Method

Overall Architecture

Given a clean point cloud \(P \in \mathbb{R}^{n \times 3}\) and a victim 3D classifier \(f\) with ground-truth label \(y\), HHA optimizes coordinate perturbations \(\Delta \in \mathbb{R}^{n \times 3}\) such that \(f(P + \Delta) \neq y\) while minimizing perceptual and structural distortion. The overall pipeline proceeds in three coordinated stages: first, point coordinates are mapped into the Poincaré ball model of hyperbolic space via an exponential map; second, the input shape is decoupled into multi-level geometric spatial subsets via recursive FPS and semantic part components via part segmentation; third, localized bidirectional hyperbolic Chamfer distances are computed for every substructure and minimized alongside misclassification loss in a unified optimization scheme.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Input Point Cloud P & Target Classifier f"] --> B["Poincaré Hyperbolic Embedding<br/>Curvature-aware exponential mapping"]
    A --> C["Dual Hierarchical Decomposition"]
    C -->|Recursive FPS partitioning| D["Geometric Hierarchy Tree P_m^(g)"]
    C -->|Part segmentation & adjacent merging| E["Semantic Hierarchy Tree P_m^(s)"]
    B & D & E --> F["Localized Hyperbolic Regularization<br/>Bidirectional hyperbolic Chamfer distance"]
    F --> G["Joint Optimization Scheme<br/>C&W formulation with task & distortion loss"]
    G --> H["Imperceptible Adversarial Point Cloud P'"]

Key Designs

1. Poincaré Hyperbolic Embedding: Metric space matching hierarchical topology To eliminate the metric distortion incurred when modeling tree-like dependencies in Euclidean space, HHA embeds point coordinates into the \(d\)-dimensional Poincaré ball model \(\mathbb{D}_c^d = \{ x \in \mathbb{R}^d : \|x\| < 1/\sqrt{c} \}\), where \(c > 0\) denotes the negative curvature. Each 3D point \(p_i \in \mathbb{R}^3\) is projected into \(\mathbb{D}_c^3\) via the origin-centered exponential map: $\(h(p_i) := \exp_c(p_i) = \tanh(\sqrt{c}\|p_i\|) \frac{p_i}{\sqrt{c}\|p_i\|}\)$ For any pair of embedded points \(x, y \in \mathbb{D}_c^d\), their geodesic distance is governed by the Riemannian metric with conformal factor \(\lambda_c^x = 2 / (1 - c\|x\|^2)\): $\(d_{\mathbb{D}_c}(x, y) = \frac{2}{\sqrt{c}} \mathrm{artanh}\left( \sqrt{c}\| -x \oplus_c y \| \right)\)$ where \(\oplus_c\) represents the Möbius addition. This formulation assigns higher penalization to peripheral distortions and naturally preserves parent-child geometric affiliations.

2. Dual Hierarchical Decomposition: Multi-scale decoupling across spatial and semantic axes Single-attribute segmentation fails to capture both continuous geometry and functional component boundaries. HHA constructs two complementary tree hierarchies: - Geometric Hierarchy: Built top-down through recursive farthest point sampling (FPS). Starting from full shape \(P_1^{(g)} = P\), half the points are selected by FPS as sub-component \(P_{m1}^{(g)}\), while the remainder forms \(P_{m2}^{(g)}\). Recursive splitting up to a predefined tree depth yields \(M_g\) multi-scale geometric substructures. - Semantic Hierarchy: Constructed from part segmentations generated by an off-the-shelf segmenter (such as PartSLIP or P3-SAM). The initial \(K\) functional parts \(\{P_m^{(s)}\}_{m=1}^K\) are iteratively merged with spatially adjacent parts to establish a coarse-to-fine hierarchy containing \(M_s\) semantic components.

3. Localized Hyperbolic Component Regularization: Multi-level distortion control To enforce local smoothness and structural fidelity at each granular scale, HHA penalizes substructure deviation in hyperbolic space. For any component \(\mathcal{P}_m \in \mathcal{P}^{(s)} \cup \mathcal{P}^{(g)}\) and its adversarial counterpart \(\mathcal{P}'_m = \{p_i + \delta_i \mid p_i \in \mathcal{P}_m\}\), the hyperbolic discrepancy is defined as a bidirectional nearest-neighbor Chamfer distance: $\(D_{\mathbb{H}}(\mathcal{P}_m, \mathcal{P}'_m) = \frac{1}{|\mathcal{P}_m|} \sum_{p_i \in \mathcal{P}_m} \min_{q_j \in \mathcal{P}'_m} d_{\mathbb{D}_c}^2\big(h(p_i), h(q_j)\big) + \frac{1}{|\mathcal{P}'_m|} \sum_{q_j \in \mathcal{P}'_m} \min_{p_i \in \mathcal{P}_m} d_{\mathbb{D}_c}^2\big(h(q_j), h(p_i)\big)\)$ By evaluating distances through hyperbolic geodesics across every sub-component, perturbations are prevented from introducing local outliers or ripping part connections apart.

Loss & Training

The overall optimization objective balances misclassification with global and hierarchical regularizations: $\(\min_{\Delta} \mathcal{L}_{\mathrm{mis}}(f, P + \Delta, y) + \lambda_1 D(P, P + \Delta) + \lambda_2^{(s)} \frac{1}{M_s} \sum_{m=1}^{M_s} D_{\mathbb{H}}\big(\mathcal{P}_m^{(s)}, {\mathcal{P}_m^{(s)}}'\big) + \lambda_2^{(g)} \frac{1}{M_g} \sum_{m=1}^{M_g} D_{\mathbb{H}}\big(\mathcal{P}_m^{(g)}, {\mathcal{P}_m^{(g)}}'\big)\)$ where \(\mathcal{L}_{\mathrm{mis}}\) is the negated cross-entropy loss, and \(D(P, P+\Delta)\) combines Euclidean Chamfer distance and \(0.1 \times\) Hausdorff distance. Hyperparameters are configured to curvature \(c=1.0\), \(\lambda_1=1.0\), and \(\lambda_2^{(s)}=\lambda_2^{(g)}=0.1\). Optimization is driven by Adam (\(\beta_1=0.9, \beta_2=0.999\), learning rate \(0.01\)) over 10 binary search rounds with 500 gradient steps per round.

Key Experimental Results

Main Results

HHA is evaluated across five representative 3D point cloud classifiers: PointNet, DGCNN, Point Transformer (PTv1), PointMLP, and Mamba3D on ModelNet40 and ScanObjectNN (a challenging real-world scanned dataset with background clutter). All competing methods are tuned to reach their highest achievable attack success rate (ASR \(\approx 100\%\)) to compare imperceptibility metrics fairly.

The table below reflects key results from Table 1 of the paper (CD \(\times 10^{-4}\), HD/Curv/EMD \(\times 10^{-2}\)):

Model Attack ModelNet40 ASR (%) ModelNet40 CD (\(\downarrow\)) ModelNet40 HD (\(\downarrow\)) ScanObjectNN ASR (%) ScanObjectNN CD (\(\downarrow\)) ScanObjectNN HD (\(\downarrow\))
PointNet PGD 100 26.582 10.777 100 20.118 7.314
GeoA3 100 4.869 0.524 100 3.425 0.655
SI-Adv 100 2.855 2.259 100 1.120 1.122
LBC (2nd best) 100 0.897 0.306 100 0.879 0.092
HHA (Ours) 100 0.603 0.279 100 0.474 0.108
DGCNN PGD 100 28.517 8.772 100 19.288 1.030
GeoA3 100 13.017 2.059 100 9.328 0.886
LBC (2nd best) 100 2.854 0.334 100 2.716 0.289
HHA (Ours) 100 2.189 0.278 100 1.308 0.157

Ablation Study

Table 3 in the paper details the individual and complementary roles of geometric (G) and semantic (S) hierarchical regularizations when attacking PointNet:

Dataset Geometric Reg. (G) Semantic Reg. (S) CD (\(10^{-4}\)) HD (\(10^{-2}\)) \(\ell_2\) Curv (\(10^{-2}\)) EMD (\(10^{-2}\)) Note
ModelNet40 \(\checkmark\) \(\times\) 0.686 0.301 0.397 0.182 0.431 Geometric hierarchy alone
\(\times\) \(\checkmark\) 0.621 0.279 0.359 0.168 0.375 Semantic hierarchy alone
\(\checkmark\) \(\checkmark\) 0.603 0.279 0.334 0.164 0.361 Full model (Best)
ScanObjectNN \(\checkmark\) \(\times\) 0.510 0.154 0.405 0.611 0.523 Geometric hierarchy alone
\(\times\) \(\checkmark\) 0.498 0.121 0.385 0.528 0.444 Semantic hierarchy alone
\(\checkmark\) \(\checkmark\) 0.474 0.108 0.379 0.523 0.438 Full model (Best)

Key Findings

  1. Hyperbolic vs. Euclidean Space (Table 4): Replacing the hyperbolic distance with Euclidean distance while keeping identical dual hierarchies substantially deteriorates imperceptibility (attacking PointNet on ModelNet40 causes CD to rise from \(0.603 \times 10^{-4}\) to \(1.034 \times 10^{-4}\) and HD from \(0.279 \times 10^{-2}\) to \(0.511 \times 10^{-2}\)). Curvature \(c=1.0\) yields optimal performance.
  2. Structural Coherence Metrics (Table 2): Quantified through semantic structural coherence (SSC) and geometric structural coherence (GSC), HHA consistently achieves the lowest distortion across all models and datasets (e.g., SSC of 0.11 on PointNet / ModelNet40, compared to 0.43 for LBC and 2.18 for PGD), validating that hierarchical fidelity is directly preserved.
  3. Defense Robustness and Physical Transferability (Table 8, Fig. 6): Under adversarial training (AT) defense on PointNet, HHA maintains a 93.1% ASR on ModelNet40, far exceeding LBC (81.4%) and GeoA3 (52.0%). In physical 3D-printing and re-scanning trials, adversarial point clouds reliably retain their misclassification (e.g., table misclassified as desk).

Highlights & Insights

  • Geometric Prior Meets Non-Euclidean Space: Explicitly identifies the intrinsic multi-scale hierarchical nature of 3D objects and leverages Poincaré hyperbolic geometry to represent it without distortion, shifting the paradigm from flat Euclidean tangent approximations to curved spaces.
  • Dual-Branch Decoupling: Decomposing point clouds along spatial density (recursive FPS) and functional semantic parts (segmenter) ensures both fine-grained geometric smoothness and macro-level component integrity.
  • Cross-Setting Versatility: Demonstrates seamless integration into black-box gradient-free query setups (SimBA, SimBA++) and physical fabrication pipelines while maintaining runtimes comparable to baseline optimization attacks (~12.04 s per sample).

Limitations & Future Work

  • Computational Overhead: Computing nearest neighbors across multiple tree levels on hyperbolic manifolds increases runtime relative to vanilla gradient attacks (12.04 s vs. 0.80 s for PGD), though remaining faster than deformation-based methods like HIT-Adv (37.76 s).
  • Reliance on External Segmenters: Semantic decomposition depends on pre-trained 3D part segmentation models (PartSLIP / P3-SAM). While ablation (Table 6) shows resilience to segmentation noise, complex or out-of-domain categories may introduce coarse part groupings.
  • Defense Inversion Opportunity: As highlighted by the authors, hyperbolic hierarchical metrics (SSC/GSC) clearly separate benign shapes from adversarial distortions, offering an intriguing pathway toward developing novel 3D anomaly detectors.
  • vs GeoA3 & LBC: GeoA3 uses differential surface properties (curvature and normals) while LBC employs barycentric lattices; both operate in Euclidean approximations. HHA captures macro-to-micro hierarchical dependencies in hyperbolic space, drastically reducing overall structural distortion while maintaining smooth surfaces.
  • vs HIT-Adv: HIT-Adv concentrates deformations in salient regions, frequently triggering rigid-like whole-body displacements with artificially high CD/HD metrics. HHA regularizes perturbations at all sub-levels, yielding superior imperceptibility in both quantitative metrics and visual appearance.

Rating

  • Novelty: ⭐⭐⭐⭐⭐ [Pioneering integration of hyperbolic Poincaré space with dual hierarchical decomposition for point cloud adversarial attacks]
  • Experimental Thoroughness: ⭐⭐⭐⭐⭐ [Comprehensive benchmarking across 5 classifiers, 2 synthetic and real datasets, 6 distortion metrics, 5 defenses, and 3D print verification]
  • Writing Quality: ⭐⭐⭐⭐⭐ [Clear mathematical derivation, cohesive motivation, and thorough visual and tabular ablation]
  • Value: ⭐⭐⭐⭐⭐ [Provides fundamental insights into geometric representation for 3D adversarial robustness and future defense design]