GeoBA: Stealthy Geometric Poisoning on 3D Point Cloud

ICLR 2026 Conference Submission8844 Authors

Keywords: Point Cloud Security; Backdoor Attack

Abstract:

Point cloud backdoor attacks exploit carefully crafted trigger patterns to manipulate deep neural networks (DNNs), causing misclassification when specific input patterns are encountered. Existing approaches primarily rely on (1) explicit trigger injection (e.g., adding a specific shape) or (2) basic geometric transformations (e.g., rotation, scaling) to generate poisoned samples.
However, such trigger patterns are often easily detected by the human eye or statistical analysis, undermining the stealth and effectiveness of the attack.
To this end, we propose GeoBA, a stealthy geometric poisoning backdoor attack that embeds imperceptible yet robust triggers into point clouds with minimal geometric perturbation. Specifically, we first transform point clouds into a spherical domain, where subtle phase perturbations are applied to introduce the backdoor pattern while preserving the global geometric structure. This perturbation effectively induces the model to learn the trigger while avoiding noticeable shape deviations. A controlled inverse transformation then maps the poisoned samples back to the original space, ensuring their imperceptibility and robustness to existing defenses.
Experiments show that GeoBA consistently triggers backdoors across mainstream 3D architectures (e.g., Mamba3D, PointMLP), with excellent stealth, transferability, and robustness—highlighting overlooked security risks in geometric transformations. Excitingly, it only takes 4 lines of core code to achieve this. The code will be released promptly.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Submission Number: 8844