Transferable Adversarial Attacks on 3-D Point Cloud Semantic Segmentation via Diffusion Models in Autonomous Driving

With the rapid advancement of LiDAR-based 3D semantic segmentation, it has provided effective support for comprehensive perception in autonomous driving. However, the vulnerabilities of existing segmentation models have not been fully explored, posing potential risks to the security of autonomous systems. Existing adversarial attacks on point cloud segmentation primarily focus on applying global perturbations to point coordinates, inevitably introducing noticeable outliers and resulting in suboptimal attack performance. Inspired by the remarkable performance of diffusion models in LiDAR scene completion tasks, we propose a novel adversarial attack framework using diffusion models targeting 3D semantic segmentation. First, we model forward and reverse diffusion processes for input point cloud scenes, then introduce targeted perturbations during the reverse diffusion sampling stage. Specifically, we initialize Gaussian noise and add it to partial input point clouds, followed by stepwise denoising for point cloud reconstruction. During each denoising step, we identify the most discrimination-sensitive critical points and apply adversarial gradients exclusively to these selected points for guiding updates. Furthermore, we design a triple-loss function to supervise adversarial point cloud generation, achieving a balance between attack performance and perturbation magnitude. Finally, we conduct comprehensive experiments on two autonomous driving datasets, SemanticKITTI and nuScenes. The experimental results indicate that our method delivers significant attack performance against six mainstream semantic segmentation models, with average relative mIoU drops reaching 61.14% and 51.55% respectively. Moreover, the proposed method successfully transfers to point cloud classification and part segmentation tasks, demonstrating superior attack performance and transferability.