# The art of defense: letting networks fool the attacker

Jinlai Zhang, Yinpeng Dong, Binbin Liu, Bo Ouyang, Jihong Zhu, Minchi Kuang,
Houqing Wang, Yanmei Meng
Corresponding author: Jihong Zhu. Jinlai Zhang, Yanmei Meng are with the
College of Mechanical Engineering, Guangxi University, Nanning, China (email:
<EMAIL_ADDRESS>gxu_mengyun@163.com). Yinpeng Dong, Binbin Liu, and Bo
Ouyang are with the Department of Computer Science and Technology, Tsinghua
University, Beijing, China (email<EMAIL_ADDRESS><EMAIL_ADDRESS>oyb19@mails.tsinghua.edu.cn). Jihong Zhu, Minchi
Kuang, and Houqing Wang are with the Department of Precision Instrument,
Tsinghua University, Beijing, China (email<EMAIL_ADDRESS><EMAIL_ADDRESS>jihong_zhu@hotmail.com).

###### Abstract

Robust environment perception is critical for autonomous cars, and adversarial
defenses are the most effective and widely studied ways to improve the
robustness of environment perception. However, all of previous defense methods
decrease the natural accuracy, and the nature of the DNNs itself has been
overlooked. To this end, in this paper, we propose a novel adversarial defense
for 3D point cloud classifier that makes full use of the nature of the DNNs.
Due to the disorder of point cloud, all point cloud classifiers have the
property of permutation invariant to the input point cloud. Based on this
nature, we design invariant transformations defense (IT-Defense). We show
that, even after accounting for obfuscated gradients, our IT-Defense is a
resilient defense against state-of-the-art (SOTA) 3D attacks. Moreover, IT-
Defense do not hurt clean accuracy compared to previous SOTA 3D defenses. Our
code will be available at: https://github.com/cuge1995/IT-Defense.

Keywords: Adversarial Attack, Point Cloud Classification, Adversarial Defenses

##  I Introduction

Deep neural networks (DNN) has shown great success in many fields [1, 2, 3, 4,
5, 6]. However, they are vulnerable to maliciously generated adversarial
examples [7]. As DNN models have been implemented into various real-world
applications, _i.e_., face recognition [8] and autonomous driving [9, 7], the
research on adversarial robustness has attracted more and more attention, and
many adversarial attack algorithms have been proposed, this puts many DNN
models deployed in the real world under serious threats. Therefore, it is
crucial to conduct extensive research on adversarial defense.

Adversarial training is considered to be the most effective defense and it can
generalize across different threat models [10]. However, adversarial training
faces many problems. Firstly, the high cost of standard adversarial training
making it impractical. In order to reduce the cost of standard adversarial
training, Shafahi et al. [11] recycled the gradient information that was
computed when updating model parameters, it finally speed up adversarial
training 7 to 30 times compared to the standard adversarial training. Maksym
et al. [12] proposed the GradAlign that that prevents catastrophic overfitting
in fast gradient sign method (FGSM) training. Secondly, all adversarial
training methods cannot overcome the problem that adversarial trained model
decrease the recognition accuracy in clean samples. Another promising line of
defense against adversarial examples is to randomize the inputs or the model
parameters [13]. The randomize of the model parameters is to sample weights of
networks from some distribution [14, 15, 16], however, it needs to adapted
with the target networks. The random transforms to the input in 2D image as
defense methods [17, 18, 19, 20] has been studied extensively, and have shown
excellent robustness, but it rarely explored in 3D point cloud. In this paper,
we focus on input random transforms in 3D point cloud.

As point out in [13], any deterministic classifier could be outperformed by a
randomized one in terms of robustness. We therefore ask, can we build a
randomized classifier that with consistent clean accuracy? Motivated by this
question, we observed that the 3D point cloud classifier’s property can be
used to build the randomized classifier. As shown in Figure 1, due to the
unordered nature of 3D point clouds, most point cloud analysis DNNs are
invariant to the order permutation of the input point cloud. In this paper, we
utilize this property to transform the input point cloud, and finally build
the randomized point cloud classifier.

Figure 1: The permutation invariance property of point cloud. Where $N$ denote
the numbers of orderless points, $D$ denote the numbers of dimensions of
coordinate.

The main contributions of this paper are summarized as follows:

  * •

To the best of our knowledge, invariant transformations defense (IT-Defense)
is the first work that uses the networks’ property to break the strongest
gradient based attacks. It breaks the attack success rate from 100% to almost
0%.

  * •

Our IT-Defense have no impact on clean accuracy, which is significantly better
than previous defense methods.

  * •

IT-Defense is compatible to different DNNs and adversarial defense methods,
which can serve as a basic network module for 3D point cloud adversarial
defense.

##  II Related Work

Adversarial attacks on images. The deep neural networks are vulnerable to
adversarial examples, it was firstly found in the image domain [21]. Then a
bunch of algorithms to generate adversarial examples or to attack the deep
neural networks are proposed [22, 23, 24, 25]. Which can be summarized as
white-box attacks and black-box attacks [10]. Most attacks in white-box
setting are based on the input gradient. The fast gradient method (FGM) [26]
generates adversarial examples by one-step update towards the input gradient.
The iterative version of FGM (IFGM) [27] generate adversarial examples by
small steps towards the gradient direction. A momentum term was introduced by
[28] to stabilize the update direction during the iterations, which was known
as MIFGM. The projected gradient descent method (PGD) adopts random starts
during the iterations, which was served as a baseline in first-order
adversary. The C&W attack [29] turn the process of obtaining adversarial
examples into an optimization problem, and used the Adam [30] for
optimization. This algorithm was heavily used in recent point cloud attack
research.

Adversarial attacks on point clouds. Due to the safety-critical applications
of the point cloud in robotics and safe-driving cars, 3D point clouds has
attracted many researchers in the computer vision community. However, its
robustness is relatively under-explored compared to the image domain. [31]
first proposed to generate adversarial point clouds examples via C&W attack,
which introduced two point cloud attacks, point perturbation and adding. The
point adding attack can further divide by adding independent points, adding
clusters, and adding objects. However, the generate adversarial point clouds
examples are very messy, which can be easily perceivable by humans. The knn
attack [32] adopted a kNN distance constraint, a clipping and a projection
operation to generate more smooth and imperceptible adversarial point clouds
examples. The Geometry-Aware Adversarial Attack ($GeoA^{3}$) [33] further
improved the imperceptible to humans. The perturbation based attacks can be
removed by statistical outlier removal (SOR) [34] method that removes points
with a large kNN distance if the perturbation is too large. To solve this
problem, [35] developed the JGBA attack, which is an efficient attck to SOR
defense. Besides, the point drop attack [36] was developed by a gradient based
saliency map, which iteratively remove the most important points. Moreover,
the AdvPC [37] improved the transferability of adversarial point cloud
examples by utilizing a point cloud auto-encoder, and the LG-GAN [38] utilized
the powerful GANs [39] to generate adversarial examples guided by the input
target labels. However, most of those attacks are integrate the gradient
information from the input, which can be a weakness.

Adversarial defenses. To overcome the threat of adversarial examples to DNNs,
extensive research has been conducted on defending against adversarial
attacks. Existing adversarial defense methods can be roughly divided into two
classes: attacking stage defense and testing stage defense. The adversarial
training [40, 41, 42, 43] is an effective way to improve the model’s
robustness, which have two stages defense effect. There are other defense
methods that have two stages defense effect. For example, Pang et al.[44]
proposed a novel loss, the model’s adversarial robustness is increased if the
model was trained with this loss. Thermometer encoding[45] encode values in a
discrete way. EMPIR[46] constructed ensemble models with mixed precision of
weights and activations. Ensemble diversity[47] improved robustness with a
regularization term. For the attacking stage defense, k-Winners Take All[48]
developed a novel activation function that masks the backpropagated gradient,
input transformations [19] and input randomization [49] utilized the
backpropagated transformed gradient to fool the attacker, stochastic
activation[50] replaces the dropout layer with a non-differentiable function.
Those defend methods can prevent the attacker from generating adversarial
examples effectively. For the testing stage defense, the are a lot of
adversarial examples detection methods[51, 52, 53, 54, 55] are developed, the
transformation method of Pixeldefend[56], defense-GAN[57], and sparse fourier
transform [58] transforms the adversarial examples to a normal sample, the
Mixup Inference[59], ME-Net[60], and Error Correcting Codes[61] mitigate the
adversarial perturbations by inference the adversarial examples directly.

We note that Guo et al. [19] and Xie et al. [49] also utilized input
transformation before feeding into the DNN to defend adversarial attacks,
which caused the obfuscated gradients effect and can be defeat by the
expectation over transformation (EOT) attacks proposed by[62]. However, our
work has several key differences with Guo et al. and Xie et al.. Firstly, we
used the invariant transformations of DNN, which do no harm to the DNN, but
Guo et al. and Xie et al. have some kind of accuracy drop of the standard
model. Secondly, we do not cause information loss between the original sample
and the transformed sample. Thirdly, we cannot be defeated by the EOT attack.

##  III Methodology

###  III-A An overview of point cloud attack

Let ${x}\in\mathbf{R}^{N\times 3}$ represents a set of clean 3D points
$\\{P_{i}|i=1,...,N\\}$, and $y$ denote the corresponding true label. For a
classifier $F(x):x\rightarrow y$ that outputs the prediction for an input, the
attacker wants to generate an adversarial example $x^{adv}$ which is
imperceptible by humans from $x$ but fools the classifier. We give a brief
introduction of some famous attack algorithms on 3D point cloud classifier in
this section.

FGM [26] generates adversarial example by one-step update.

$\boldsymbol{x}^{adv}=\boldsymbol{x}-\epsilon\cdot\operatorname{sign}\left(\nabla_{\boldsymbol{x}}J\left(\boldsymbol{x},y\right)\right)$
(1)

where $\nabla_{\boldsymbol{x}}J$ is the gradient of the loss function with
respect to the input $x$. $\operatorname{sign(.)}$ is the sign function that
turns the gradient value into the direction value.

I-FGM [27] generate adversarial example by small steps in a iterative fashion.

$\boldsymbol{x}_{t+1}^{adv}=\boldsymbol{x}_{t}^{adv}-\alpha\cdot\operatorname{sign}\left(\nabla_{\boldsymbol{x}}J\left(\boldsymbol{x}_{t}^{adv},y\right)\right)$
(2)

where $\alpha=\epsilon/T$ with T steps iteration, and ${x}_{0}^{adv}=x$.

MIFGM [28] introduced a momentum term to stabilize the update direction during
the iteration.

$\boldsymbol{g}_{t+1}=\mu\cdot\boldsymbol{g}_{t}+\frac{\nabla_{\boldsymbol{x}}J\left(\boldsymbol{x}_{t}^{adv},y\right)}{\left\|\nabla_{\boldsymbol{x}}J\left(\boldsymbol{x}_{t}^{adv},y\right)\right\|_{1}}$
(3)

$\boldsymbol{x}_{t+1}^{adv}=\boldsymbol{x}_{t}^{adv}-\alpha\cdot\operatorname{sign}\left(\boldsymbol{g}_{t+1}\right)$
(4)

where $g_{t}$ gathers the gradient information up to the $t$-th iteration with
a decay factor $\mu$. We mainly compare FGM, I-FGM and MIFGM with GvF-P [63],
the first self-robust point cloud defense method.

C&W [29] turn the process of obtaining adversarial examples into an
optimization problem.

$\underset{\boldsymbol{x}^{adv}}{\arg\min}\left\|\boldsymbol{x}^{adv}-\boldsymbol{x}\right\|_{p}+c\cdot
J\left(\boldsymbol{x}^{adv},y\right)$ (5)

where the loss $J$ can be different from the cross-entropy loss and many
variants are proposed for point cloud attack[32, 31, 33].

###  III-B Invariant transformation defense (IT-Defense)

Figure 2: The pipeline of our proposed IT-Defense.

In this paper, we make full use of the nature of point cloud classifiers,
i.e., the point cloud classifiers are permutation invariant to the input point
cloud’s index, and propose the invariant transformation defense (IT-Defense).
The pipeline of IT-Defense is shown in Figure 2. The IT-Defense can be
described as following:

$g(x)={\nabla_{t(\boldsymbol{x})}}J\left(t(\boldsymbol{x}),y\right)$ (6)

where $\nabla_{t(\boldsymbol{x})}J$ is the gradient of the loss function with
respect to the random input transformation $t()$ of $x$. Note that unlike
previous random input transformation defense [19, 49, 18], our transformation
is invariant to the classier $F()$. The intuition is that by randomly perturb
the index of the input point cloud, the transformed point cloud will not
affect the performance of point cloud classifier due to the orderless nature
of point cloud, but the real gradient have perturbed significantly, thus fool
the attacker.

Following, we perform some simple analysis to investigate why IT-Defense
works.

###  III-C Theoretical analysis of IT-Defense against gradient-based attacker

In the following section, we use the theory of [64] to analyze IT-Defense
against various attacks. Under the system of game theory, the relationship
between the adversarial robustness of neural networks and the complexity of
game interaction is modeled uniformly. They proved that the adversarial
perturbations mainly affect high-order interactions. They define the game-
theoretic interactions as follows:

$I(i,j)=\tilde{\phi}(i\mid N)_{j\text{ always present }}-\tilde{\phi}(i\mid
N)_{j\text{ always absent }}$ (7)

where $\tilde{\phi}(i\mid N)_{j\text{ always present }}$ denote the importance
of input variable $i$ when $j$ is always present and $\tilde{\phi}(i\mid
N)_{j\text{ always absent }}$ denote the importance of input variable $i$ when
$j$ is always absent. Then, the interactions can be decomposed into multiple
orders [65] as following:

$I(i,j)=\frac{1}{n-1}\sum_{m=0}^{n-2}I_{ij}^{(m)},\quad
I_{ij}^{(m)}=\mathbb{E}_{S\subseteq N\backslash\\{i,j\\}}[\Delta v(i,j,S)]$
(8)

where $I_{ij}^{(m)}$ represents the $m$th-order interaction. $m$ represents
the number of units in the background $S$ other than input units $i$ and $j$,
reflecting the complexity expressed by the interaction. When the background
contains more input units, $m$ is larger, and the game-theoretic interaction
between $i$ and $j$ can be regarded as a high-order interaction. When the
background contains a small number of input units, $m$ is small, the game-
theoretic interaction between $i$ and $j$ is a low-order interaction.

As shown in Figure 3, we perform I-FGM and MIFGM and IT-Defense against their
in Pointnet [66], where the lower ratio of points represent the the low-order
interactions, and higher ratio of points represent the the high-order
interactions, the results show that the adversarial example without defense
mainly affected high-order interactions, the IT-Defense mainly change the low-
order interactions, thus mitigate adversarial effects.

Figure 3: The multi-order interaction $I_{clean}^{(m)}$ and $I_{adv}^{(m)}$ of
gradient-based attacks. Our IT-Defense mainly affect the low-order
interactions, thus mitigate adversarial effects.

###  III-D Theoretical analysis of IT-Defense against optimization-based
attacker

Following Sec. III-C, two optimization-based attacker are selected, the 3D-Adv
[31] and kNN attack [32]. From Figure 4, we can observe similar results as
Sec. III-C, which means the IT-Defense mainly change the low-order
interactions to overcome adversarial effects.

Figure 4: The multi-order interaction $I_{clean}^{(m)}$ and $I_{adv}^{(m)}$ of
optimization-based attacks. Our IT-Defense mainly affect the low-order
interactions, thus mitigate adversarial effects.

###  III-E Theoretical analysis of IT-Defense against adaptive attacks

Recent works on robust defense [67, 62, 68] suggest that the proposed new
defense algorithms should take a further evaluation against the corresponding
adaptive attack. Since our method transform the index the points, the
expectation over transformation (EOT) attacks proposed by[62] is expect as the
adaptive attacker, due to its excellent performance in adaptive attack to the
input transform based methods [18]. Following [18], we use the EOT to build a
strong attacker. The EOT [69] is defined as follows:

Figure 5: The multi-order interaction $I_{clean}^{(m)}$ and $I_{adv}^{(m)}$ of
Pointnet and Pointnet with our proposed IT-Defense, and IT-Defense with EOT
attack. The EOT attack further increased the gap in low-order interactions,
thus not effective to attack the IT-Defense.

$\nabla_{x}\mathbb{E}_{r}\left[f_{r}(x)\right]=\mathbb{E}_{r}\left[\nabla_{x}f_{r}(x)\right]\approx\frac{1}{n}\sum_{i=1}^{n}\nabla_{x}f_{r_{i}}(x)$
(9)

where $f_{r}(x)$ is the randomized classifier, and the $r_{i}$ are independent
draws of the randomness transformation. But our transformation is big enough
(up to $1024!$ or $2048!$ depends on $n$), given one transformation $t(.)$ of
our defender, the probability of correctly sample this $t(.)$ by an attacker
is $1/{n!}$, which is sufficently small, simply repeat the transformation
multiple times (usually 10 to 30 times in most EOT attacks literatures [67])
cannot recover the true gradient. As shown in Figure 5, the EOT attack further
increased the gap in low-order interactions compare to without EOT attack,
thus it is not effective to attack the IT-Defense. We further verified this by
experiment.

##  IV Experiments

In this section, we present the experimental results to demonstrate the
effectiveness of the proposed method. We first specify the experimental
settings. Then we conduct extensive experiments to study the defense effects
of IT-Defense. And perform comparative experiments to analyze IT-Defense in
detail.

###  IV-A Experimental Settings

We implement all experiments on a Linux server with 8 Nvidia RTX 3090 GPUs.
For point cloud attacks, we use the ModelNet40 [70] test set kindly provided
by[71], which also contained the targeted label for targeted attacks. We also
select three commonly used networks in 3D computer vision area [72, 73] for
evaluation, _i.e_., PointNet [66], PointNet++ [3], and DGCNN [74], the SOTA
networks such as PointConv [75], PAConv [76], Point Cloud Transformer (PCT)
[77] and CurveNet [78] are also selected for KNN attack evaluation. The
FGM[26], I-FGM[27], MIFGM[28] and PGD[79] attacks were selected as the gray-
box attacker. We follow the same settings as [63] for point cloud attack.
Moreover, the untargeted point dropping attack [36], and the C&W attack’s[29]
variant kNN attack [32] and 3D-Adv attack [31] were further verified our
effective defense ability. The JGBA attack and $GeoA^{3}$ attack were
implemented by their open-sourced code and dataset. Experiments are repeated 5
times. The estimated gradient of EOT is averaged by 10 random transformations.

###  IV-B Results

####  IV-B1 IT-Defense does not reduce clean accuracy.

IT-Defense only change the order of points, it does not reduce clean accuracy.
In this section, we validate this via experiments. As shown in Table I, unlike
previous SOTA defenses that reduce the clean accuracy, such as the Simple
Random Sampling [80] (SRS), Statistical Outlier Removal [81] (SOR), DUP-Net
[34] and the IF-Defense [71] are reduced the clean accuracy up to 4%, the IT-
Defense that build upon the property of point cloud recognition model does not
reduce clean accuracy. This is an important property, which means that IT-
Defense can be embedded in any point cloud recognition model.

Table I: Classification accuracy of various defense methods on clean ModelNet40 by Pointnet. The best results for each row are emphasized as bold. Model | Clean | SRS [80] | SOR [81] | DUP-Net [34] | IF-Defense [71] | Ours
---|---|---|---|---|---|---
PointNet | 88.49 | 87.24 | 87.80 | 86.83 | 84.20 | 88.49

####  IV-B2 IT-Defense against various attackers.

In this section, we show the experimental results of the proposed invariant
transformation defense (IT-Defense) method with different attackers. We
firstly perform the classical adversarial attacks to our IT-Defense, the
results are shown in Table II. We report the success rates of FGM, I-FGM,
I-FGM+EOT, PGD, and MIFGM attacks against our defense method and in no defense
setting. The I-FGM+EOT attack cannot break our defense and getting worse
results than I-FGM attack. The results shown that our defense improve the
robustness of the model against various attacks significantly, our method
break the success rate from 98.87 to 0.45 in some case.

Table II: The success rates (%) of targeted attacks.$*$ denotes that results are reported in GvG-P [63]. Model | Attack | FGM | I-FGM | I-FGM+EOT | PGD | MIFGM
---|---|---|---|---|---|---
Pointnet | No Defense | 3.69 | 98.87 | 98.87 | 98.78 | 85.29
IT-Defense | 0.64$\pm 0.05$ | 0.49$\pm 0.06$ | 0.20$\pm 0.04$ | 0.93$\pm 0.05$ | 0.47$\pm 0.04$
Pointnet++ | No Defense | 2.96 | 92.63 | 92.63 | 93.40 | 12.48
GvG-P* | 3.20 | 69.00 | - | 69.41 | 37.88
IT-Defense |  3.03$\pm 0.07$ | 1.27$\pm 0.16$ | 0.23$\pm 0.10$ | 1.99$\pm 0.21$ | 1.21$\pm 0.11$
DGCNN | No Defense | 3.36 | 78.65 | 78.65 | 78.00 | 23.34
IT-Defense | 3.26$\pm 0.05$ | 1.03$\pm 0.04$ | 0.32$\pm 0.04$ | 1.80$\pm 0.12$ | 1.07$\pm 0.09$

The point dropping attack [36] is based on the saliency maps of the input
point cloud, where also used the gradient in some degree, we therefore perform
this attack to our defense. For fairness, we used the same settings with [72,
71] and used classification accuracy to compare with state of the art defense
algorithms, the results are shown in Table III. We can see that for Drop 200
and Drop 100 attacks, the IT-defense leads to better results than the IF-
Defense. The results verified that our defense method can be applied to any
kind of attack based on gradient information.

Table III: Classification accuracy of various defense methods on ModelNet40 under point dropping attack [36]. Drop 200 and Drop 100 denote the dropping points is 200 and 100 respectively. $*$ denotes that results are reported in IF-Defense [71]. We report the best result of three IF-Defense. The best results for each row are emphasized as bold. Attack | Model | No Defense$*$ | SRS$*$ | SOR$*$ | DUP-Net$*$ | IF-Defense$*$ | Ours
---|---|---|---|---|---|---|---
Drop 200 | PointNet | 40.24 | 39.51 | 42.59 | 46.92 | 66.94 | 88.02$\pm 0.19$
PointNet++ | 68.96 | 39.63 | 69.17 | 72.00 | 79.09 | 86.83$\pm 0.49$
| DGCNN | 55.06 | 63.57 | 59.36 | 36.02 | 73.30 | 83.01$\pm 0.15$
Drop 100 | PointNet | 64.67 | 63.57 | 64.75 | 67.30 | 77.76 | 88.33$\pm 0.19$
PointNet++ | 80.19 | 64.51 | 74.16 | 76.38 | 84.56 | 88.31$\pm 0.16$
DGCNN | 75.16 | 49.23 | 64.68 | 44.45 | 83.43 | 87.86$\pm 0.10$

We further verified our defense on kNN attack [32], 3D-Adv attack [31], JGBA
attack[35] and $GeoA^{3}$ attack[33], three of them are the C&W attack’s[29]
variant in point cloud. The C&W attack turns the process of obtaining
adversarial examples into an optimization problem, but the gradient
information is needed in every iteration step within the optimization process.
We report the success rates of the kNN attack [32], the 3D-Adv attack [31],
the JGBA attack[35] and the $GeoA^{3}$ attack[33] against IT-Defense in Table
IV. In general, the IT-Defense consistently breaks the success rate from a
high level (near 100%) to near 0%, which means that we can totally break the
attack effect caused by the attacker.

Table IV: The success rates (%) of targeted attacks of kNN attack [32], 3D-Adv attack [31], JGBA attack[35] and the $GeoA^{3}$ attack[33]. The best results for each row is emphasized as bold. Attack | Model | No Defense | IT-Defense
---|---|---|---
kNN | PointNet | 85.45 | 0.41
PointNet++ | 99.96 | 0.51
DGCNN | 60.53 | 0.69
PointConv [75] | 89.75 | 0.61
PAConv [76] | 99.96 | 2.76
PCT [77] | 98.78 | 0.59
CurveNet [78] | 85.53 | 0.36
3D-Adv | PointNet | 100.00 | 0.20
PointNet++ | 100.00 | 0.61
DGCNN | 100.00 | 0.36
JGBA | PointNet | 100.00 | 0.19
$GeoA^{3}$ | PointNet | 100.00 | 32.00

###  IV-C Comparative experiments

In this section, we explore different attack settings on IT-Defense.

####  IV-C1 Influence of perturbation budget

As suggest in [82], the perturbation budget have significant impact on the
attack performance. We therefore perform experiment with different
perturbation budget in the range of $[0.05,0.40]$, with point cloud in
$[0,1]$. As shown in Figure 6, our IT-Defense is robust within the $0.25$
perturbation budget, it’s big enough to be easily detected by humans.

####  IV-C2 Influence of attack steps

The number of attack steps of gradient-based attack is another important
factor that affect the attack performance. The results are shown in Figure 6,
for Pointnet and DGCNN, the Attack Success Rate(%) increased with the number
of attack steps for IFGM without our IT-Defense, but maintain almost constant
zero Attack Success Rate(%) with IT-Defense.

Figure 6: The Attack Success Rate(%) vs perturbation budget and number of
steps for IFGM attack, the Attack Success Rate(%) vs number of iterations for
kNN attack.

####  IV-C3 Influence of attack iterations

The number of iterations of optimization-based attack is a vital variable
during attack. We perform KNN attack [32] on Pointnet and DGCNN with the
iterations within $[500,2500]$. As shown in Figure 6, for Pointnet and DGCNN,
similar to the number of steps for IFGM attack, the Attack Success Rate(%)
increased slightly with the number of attack iterations for KNN attack without
our IT-Defense, but maintain almost constant zero Attack Success Rate(%) with
IT-Defense.

####  IV-C4 Influence of EOTs

In order to validate our IT-Defense resistent to EOTs, we scale the number of
EOTs up to 100. To the best our knowledge, this is the largest EOT have been
performed. The results are shown in Table V, the Attack Success Rate(%)
increased slightly with the number of EOTs initially, but decreased as the
EOTs bigger than 50, indicating that EOT attack is not effective to attack our
IT-Defense.

Figure 7: The visualization of adversarial point cloud samples with different perturbation budget. For each group within the same budget, the left and right are adversarial point cloud samples without and with IT-Defense, respectively. Table V: The success rates (%) of IT-Defense against EOT attack. EOTs | 10 | 20 | 30 | 40 | 50 | 60 | 70 | 80 | 90 | 100
---|---|---|---|---|---|---|---|---|---|---
Success rates | 0.20 | 0.41 | 0.41 | 0.41 | 0.32 | 0.32 | 0.28 | 0.28 | 0.24 | 0.24

####  IV-C5 Understanding the IT-Defense

To figure out what IT-Defense brings to the adversarial point cloud examples,
we visualised the airplane and chair of clean sample and adversarial samples
without and with IT-Defense under different perturbation budget. From Figure
7, we can conclude that IT-Defense can help models escape the ’adversarial
region’ when the perturbation budget is small, and making adversarial point
cloud examples human recognizable when the perturbation budget is large.

##  V Conclusion

In this paper, we propose a defense strategy that uses the networks’ property
to break the adversarial attacks. Our findings are insightful, the network’s
property is utilized to defend against attacks, and the results show that our
defense can break most of the existing point cloud attacks. It is worth
mentioning that, although IT-Defense was shown to be a powerful defense
mechanism against adversarial attacks, one limitation might come across, IT-
Defense require the deep neural networks has some invariant transformations of
input. Note that our method can only resist attacks for finding adversarial
samples, but the adversarial samples generated from the original model can
transferred well to IT-Defense. However, our method can easily incorporate
with the model with higher robustness, such as models trained with ensemble
adversarial training[83] and PointCutMix[72], and combined with other defense
methods, thus not only making the attacker hard to generate effective
adversarial examples, but also letting our AI system more robust resist to
adversarial samples generated by other models.

##  VI Acknowledgments

The project was supported by Innovation Project of Guangxi Graduate Education
(YCBZ2021019).

## References

  * [1] J. Redmon, S. Divvala, R. Girshick, and A. Farhadi, “You only look once: Unified, real-time object detection,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 779–788, 2016.
  * [2] T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, et al., “Language models are few-shot learners,” arXiv preprint arXiv:2005.14165, 2020.
  * [3] C. R. Qi, L. Yi, H. Su, and L. J. Guibas, “Pointnet++: Deep hierarchical feature learning on point sets in a metric space,” Advances in neural information processing systems, vol. 30, pp. 5099–5108, 2017.
  * [4] Z. Wu, C. Shen, and A. Van Den Hengel, “Wider or deeper: Revisiting the resnet model for visual recognition,” Pattern Recognition, vol. 90, pp. 119–133, 2019.
  * [5] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770–778, 2016.
  * [6] J. Zhang, Y. Meng, J. Wu, J. Qin, T. Yao, S. Yu, et al., “Monitoring sugar crystallization with deep neural networks,” Journal of Food Engineering, vol. 280, p. 109965, 2020.
  * [7] X. Xu, J. Zhang, Y. Li, Y. Wang, Y. Yang, and H. T. Shen, “Adversarial attack against urban scene segmentation for autonomous vehicles,” IEEE Transactions on Industrial Informatics, vol. 17, no. 6, pp. 4117–4126, 2020\.
  * [8] J. Guo, X. Zhu, C. Zhao, D. Cao, Z. Lei, and S. Z. Li, “Learning meta face recognition in unseen domains,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6163–6172, 2020.
  * [9] S. Shi, C. Guo, L. Jiang, Z. Wang, J. Shi, X. Wang, and H. Li, “Pv-rcnn: Point-voxel feature set abstraction for 3d object detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10529–10538, 2020.
  * [10] Y. Dong, Q.-A. Fu, X. Yang, T. Pang, H. Su, Z. Xiao, and J. Zhu, “Benchmarking adversarial robustness on image classification,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 321–331, 2020.
  * [11] A. Shafahi, M. Najibi, M. A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, and T. Goldstein, “Adversarial training for free!,” Advances in Neural Information Processing Systems, vol. 32, 2019.
  * [12] M. Andriushchenko and N. Flammarion, “Understanding and improving fast adversarial training,” Advances in Neural Information Processing Systems, vol. 33, pp. 16048–16059, 2020.
  * [13] R. Pinot, R. Ettedgui, G. Rizk, Y. Chevaleyre, and J. Atif, “Randomization matters how to defend against strong adversarial attacks,” in International Conference on Machine Learning, pp. 7717–7727, PMLR, 2020.
  * [14] X. Liu, M. Cheng, H. Zhang, and C.-J. Hsieh, “Towards robust neural networks via random self-ensemble,” in Proceedings of the European Conference on Computer Vision (ECCV), pp. 369–385, 2018.
  * [15] X. Liu, Y. Li, C. Wu, and C.-J. Hsieh, “Adv-bnn: Improved adversarial defense through robust bayesian neural network,” arXiv preprint arXiv:1810.01279, 2018.
  * [16] S. Lee, H. Kim, and J. Lee, “Graddiv: Adversarial robustness of randomized neural networks via gradient diversity regularization,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
  * [17] Y. Zhang and P. Liang, “Defending against whitebox adversarial attacks via randomized discretization,” in The 22nd International Conference on Artificial Intelligence and Statistics, pp. 684–693, PMLR, 2019.
  * [18] E. Raff, J. Sylvester, S. Forsyth, and M. McLean, “Barrage of random transforms for adversarially robust defense,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6528–6537, 2019.
  * [19] C. Guo, M. Rana, M. Cisse, and L. Van Der Maaten, “Countering adversarial images using input transformations,” arXiv preprint arXiv:1711.00117, 2017\.
  * [20] J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified adversarial robustness via randomized smoothing,” in International Conference on Machine Learning, pp. 1310–1320, PMLR, 2019.
  * [21] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013.
  * [22] S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2574–2582, 2016\.
  * [23] S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1765–1773, 2017.
  * [24] J. Su, D. V. Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,” IEEE Transactions on Evolutionary Computation, vol. 23, no. 5, pp. 828–841, 2019.
  * [25] K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1625–1634, 2018.
  * [26] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572, 2014.
  * [27] A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” arXiv preprint arXiv:1611.01236, 2016.
  * [28] Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185–9193, 2018.
  * [29] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 ieee symposium on security and privacy (sp), pp. 39–57, IEEE, 2017.
  * [30] D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980, 2014.
  * [31] C. Xiang, C. R. Qi, and B. Li, “Generating 3d adversarial point clouds,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 9136–9144, 2019.
  * [32] T. Tsai, K. Yang, T.-Y. Ho, and Y. Jin, “Robust adversarial objects against deep learning models,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, pp. 954–962, 2020.
  * [33] Y. Wen, J. Lin, K. Chen, C. P. Chen, and K. Jia, “Geometry-aware generation of adversarial point clouds,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2020.
  * [34] H. Zhou, K. Chen, W. Zhang, H. Fang, W. Zhou, and N. Yu, “Dup-net: Denoiser and upsampler network for 3d adversarial point clouds defense,” in Proceedings of the IEEE International Conference on Computer Vision, pp. 1961–1970, 2019.
  * [35] C. Ma, W. Meng, B. Wu, S. Xu, and X. Zhang, “Efficient joint gradient based attack against sor defense for 3d point cloud classification,” in Proceedings of the 28th ACM International Conference on Multimedia, pp. 1819–1827, 2020.
  * [36] T. Zheng, C. Chen, J. Yuan, B. Li, and K. Ren, “Pointcloud saliency maps,” in Proceedings of the IEEE International Conference on Computer Vision, pp. 1598–1606, 2019.
  * [37] A. Hamdi, S. Rojas, A. Thabet, and B. Ghanem, “Advpc: Transferable adversarial perturbations on 3d point clouds,” in European Conference on Computer Vision, pp. 241–257, Springer, 2020.
  * [38] H. Zhou, D. Chen, J. Liao, K. Chen, X. Dong, K. Liu, W. Zhang, G. Hua, and N. Yu, “Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep networks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10356–10365, 2020.
  * [39] I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, “Generative adversarial networks,” arXiv preprint arXiv:1406.2661, 2014.
  * [40] A. Shafahi, M. Najibi, A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, and T. Goldstein, “Adversarial training for free!,” arXiv preprint arXiv:1904.12843, 2019.
  * [41] D. Zhang, T. Zhang, Y. Lu, Z. Zhu, and B. Dong, “You only propagate once: Accelerating adversarial training via maximal principle,” arXiv preprint arXiv:1905.00877, 2019.
  * [42] E. Wong, L. Rice, and J. Z. Kolter, “Fast is better than free: Revisiting adversarial training,” arXiv preprint arXiv:2001.03994, 2020.
  * [43] T. Na, J. H. Ko, and S. Mukhopadhyay, “Cascade adversarial machine learning regularized with a unified embedding,” arXiv preprint arXiv:1708.02582, 2017.
  * [44] T. Pang, K. Xu, Y. Dong, C. Du, N. Chen, and J. Zhu, “Rethinking softmax cross-entropy loss for adversarial robustness,” arXiv preprint arXiv:1905.10626, 2019.
  * [45] J. Buckman, A. Roy, C. Raffel, and I. Goodfellow, “Thermometer encoding: One hot way to resist adversarial examples,” in International Conference on Learning Representations, 2018.
  * [46] S. Sen, B. Ravindran, and A. Raghunathan, “Empir: Ensembles of mixed precision deep networks for increased robustness against adversarial attacks,” arXiv preprint arXiv:2004.10162, 2020.
  * [47] T. Pang, K. Xu, C. Du, N. Chen, and J. Zhu, “Improving adversarial robustness via promoting ensemble diversity,” in International Conference on Machine Learning, pp. 4970–4979, PMLR, 2019.
  * [48] C. Xiao, P. Zhong, and C. Zheng, “Resisting adversarial attacks by $k$-winners-take-all,” arXiv preprint arXiv:1905.10510, 2019.
  * [49] C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,” arXiv preprint arXiv:1711.01991, 2017.
  * [50] G. S. Dhillon, K. Azizzadenesheli, Z. C. Lipton, J. Bernstein, J. Kossaifi, A. Khanna, and A. Anandkumar, “Stochastic activation pruning for robust adversarial defense,” arXiv preprint arXiv:1803.01442, 2018.
  * [51] K. Roth, Y. Kilcher, and T. Hofmann, “The odds are odd: A statistical test for detecting adversarial examples,” in International Conference on Machine Learning, pp. 5498–5507, PMLR, 2019.
  * [52] X. Yin, S. Kolouri, and G. K. Rohde, “Adversarial example detection and classification with asymmetrical adversarial training,” arXiv preprint arXiv:1905.11475, 2019.
  * [53] T. Yu, S. Hu, C. Guo, W.-L. Chao, and K. Q. Weinberger, “A new defense against adversarial images: Turning a weakness into a strength,” arXiv preprint arXiv:1910.07629, 2019.
  * [54] Y. Li, J. Bradshaw, and Y. Sharma, “Are generative classifiers more robust to adversarial attacks?,” in International Conference on Machine Learning, pp. 3804–3814, PMLR, 2019.
  * [55] X. Ma, B. Li, Y. Wang, S. M. Erfani, S. Wijewickrema, G. Schoenebeck, D. Song, M. E. Houle, and J. Bailey, “Characterizing adversarial subspaces using local intrinsic dimensionality,” arXiv preprint arXiv:1801.02613, 2018\.
  * [56] Y. Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman, “Pixeldefend: Leveraging generative models to understand and defend against adversarial examples,” arXiv preprint arXiv:1710.10766, 2017.
  * [57] P. Samangouei, M. Kabkab, and R. Chellappa, “Defense-gan: Protecting classifiers against adversarial attacks using generative models,” arXiv preprint arXiv:1805.06605, 2018.
  * [58] M. Bafna, J. Murtagh, and N. Vyas, “Thwarting adversarial examples: An $l\\_0$-robustsparse fourier transform,” arXiv preprint arXiv:1812.05013, 2018\.
  * [59] T. Pang, K. Xu, and J. Zhu, “Mixup inference: Better exploiting mixup to defend adversarial attacks,” arXiv preprint arXiv:1909.11515, 2019.
  * [60] Y. Yang, G. Zhang, D. Katabi, and Z. Xu, “Me-net: Towards effective adversarial robustness with matrix estimation,” arXiv preprint arXiv:1905.11971, 2019.
  * [61] G. Verma and A. Swami, “Error correcting output codes improve probability estimation and adversarial robustness of deep neural networks,” Advances in Neural Information Processing Systems, vol. 32, pp. 8646–8656, 2019\.
  * [62] A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in International Conference on Machine Learning, pp. 274–283, PMLR, 2018.
  * [63] X. Dong, D. Chen, H. Zhou, G. Hua, W. Zhang, and N. Yu, “Self-robust 3d point recognition via gather-vector guidance,” in 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 11513–11521, IEEE, 2020\.
  * [64] J. Ren, D. Zhang, Y. Wang, L. Chen, Z. Zhou, Y. Chen, X. Cheng, X. Wang, M. Zhou, J. Shi, et al., “Towards a unified game-theoretic view of adversarial perturbations and robustness,” Advances in Neural Information Processing Systems, vol. 34, 2021.
  * [65] H. Zhang, S. Li, Y. Ma, M. Li, Y. Xie, and Q. Zhang, “Interpreting and boosting dropout from a game-theoretic view,” in International Conference on Learning Representations, 2020.
  * [66] C. R. Qi, H. Su, K. Mo, and L. J. Guibas, “Pointnet: Deep learning on point sets for 3d classification and segmentation,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 652–660, 2017\.
  * [67] F. Tramer, N. Carlini, W. Brendel, and A. Madry, “On adaptive attacks to adversarial example defenses,” Advances in Neural Information Processing Systems, vol. 33, pp. 1633–1645, 2020.
  * [68] N. Papernot, P. McDaniel, A. Sinha, and M. Wellman, “Towards the science of security and privacy in machine learning,” arXiv preprint arXiv:1611.03814, 2016.
  * [69] A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” in International conference on machine learning, pp. 284–293, PMLR, 2018.
  * [70] Z. Wu, S. Song, A. Khosla, F. Yu, L. Zhang, X. Tang, and J. Xiao, “3d shapenets: A deep representation for volumetric shapes,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1912–1920, 2015.
  * [71] Z. Wu, Y. Duan, H. Wang, Q. Fan, and L. J. Guibas, “If-defense: 3d adversarial point cloud defense via implicit function based restoration,” arXiv preprint arXiv:2010.05272, 2020.
  * [72] J. Zhang, L. Chen, B. Ouyang, B. Liu, J. Zhu, Y. Chen, Y. Meng, and D. Wu, “Pointcutmix: Regularization strategy for point cloud classification,” arXiv preprint arXiv:2101.01461, 2021.
  * [73] Y. Zhao, Y. Wu, C. Chen, and A. Lim, “On isometry robustness of deep 3d point cloud models under adversarial attacks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1201–1210, 2020.
  * [74] Y. Wang, Y. Sun, Z. Liu, S. E. Sarma, M. M. Bronstein, and J. M. Solomon, “Dynamic graph cnn for learning on point clouds,” Acm Transactions On Graphics (tog), vol. 38, no. 5, pp. 1–12, 2019.
  * [75] W. Wu, Z. Qi, and L. Fuxin, “Pointconv: Deep convolutional networks on 3d point clouds,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9621–9630, 2019.
  * [76] M. Xu, R. Ding, H. Zhao, and X. Qi, “Paconv: Position adaptive convolution with dynamic kernel assembling on point clouds,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 3173–3182, 2021.
  * [77] M.-H. Guo, J.-X. Cai, Z.-N. Liu, T.-J. Mu, R. R. Martin, and S.-M. Hu, “Pct: Point cloud transformer,” Computational Visual Media, vol. 7, no. 2, pp. 187–199, 2021.
  * [78] T. Xiang, C. Zhang, Y. Song, J. Yu, and W. Cai, “Walk in the cloud: Learning curves for point clouds shape analysis,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 915–924, 2021.
  * [79] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017.
  * [80] J. Yang, Q. Zhang, R. Fang, B. Ni, J. Liu, and Q. Tian, “Adversarial attack and defense on point sets,” arXiv preprint arXiv:1902.10899, 2019.
  * [81] L. Yu, X. Li, C.-W. Fu, D. Cohen-Or, and P.-A. Heng, “Pu-net: Point cloud upsampling network,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2790–2799, 2018.
  * [82] Y. Dong, Q.-A. Fu, X. Yang, T. Pang, H. Su, Z. Xiao, and J. Zhu, “Benchmarking adversarial robustness on image classification,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 321–331, 2020.
  * [83] F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” arXiv preprint arXiv:1705.07204, 2017.

|  Jinlai Zhang received the B.S. degree from Changsha University of Science
and Technology, Changsha, China, in 2017. He is currently pursuing the Ph.D.
with the College of Mechanical Engineering, Guangxi University. His research
interests include 3D deep learning and time series forecasting.
---|---
|  Yinpeng Dong received his BS and PhD de- grees from the Department of
Computer Science and Technology in Tsinghua University, where he is currently
a postdoctoral researcher. His research interests are primarily on the adver-
sarial robustness of machine learning and deep learning. He received Microsoft
Research Asia Fellowship and Baidu Fellowship.
---|---
|  Binbin Liu received the B.S. degree from University of Science and
Technology of China, in 2019. He is currently pursuing the Master with the
Department of Computer Science and Technology, Tsinghua University. His
research interests include 3D deep learning and robustness of object
detection.
---|---
|  Bo Ouyang received B.E. degree from National University of Defense
Technology in 2011. He is currently working towards the MA. degree in the
Department of Computer Science and Technology from Tsinghua University. His
research interests include Computer Vision, Deep Learning, and Natural
Language Processing.
---|---
|  Jihong Zhu received his Ph.D. degree from Nanjing University of Science and
Technology, Nanjing, in 1995. Currently, he is a professor with the Department
of Precision Instrument,Tsinghua University, Beijing, China. His research
interests include flight control and robotics.
---|---
|  Minchi Kuang received his doctorate from Tsinghua University in 2017. He is
now working as an assistant researcher in the Department of precision
instruments of Tsinghua University. His main research interests are artificial
intelligence and intelligent control.
---|---
|  Houqing Wang received the B.S. degree in ship electrical and electronic
engineering from the Shanghai Maritime University in 2015, and M.S. and Ph.D.
degrees both in power electronics and power drives from the Shanghai Maritime
University, Shanghai, China, in 2017 and 2020, respectively. From April to
September 2019, he was a Research Assistant with the Centre for Smart Energy
Conversion and Utilization Research in the City University of Hong Kong. Since
January 2021, he has been with the Tsinghua University, Beijing, China, where
he is currently a Postdoctor in the Department of Precision Instrument. His
research interests include digital control techniques of power converters,
renewable energy generation systems, and battery energy storage systems.
---|---
|  Yanmei Meng received the Ph.D. degree from Hefei University of Technology,
Hefei, China, in 2003, respectively. She is currently a Professor with the
College of Mechanical Engineering, Guangxi University. Her research interest
includes intelligent detection and control technology, computer vision.
---|---