FAGA: Feature-Level Gradient Momentum Attack for Transferable 3D Adversarial Point Clouds

While widely employed in 3D applications like virtual reality (VR) and autonomous driving, neural networks for point cloud processing have demonstrated an alarming vulnerability to adversarial attacks, particularly under blackbox settings. Among black-box attacks, transfer-based methods craft adversarial examples on a surrogate model with high transferability to multiple victim models, making them well-suited for realistic scenarios and essential for robustness assessment. However, current transfer-based 3D adversarial attack methods often over-rely on the surrogate model and become trapped in local optima, resulting in degraded transferability. To address this limitation, we propose a novel framework, the FeAturelevel Gradient momentum Attack (FAGA), which generates adversarial examples by directly perturbing the intermediate features of the surrogate model to produce more generalized cross-model attacks. We observe that gradients from individual optimization steps tend to overfit the surrogate model, resulting in sub-optimal transferability. Thus we employ a gradient momentum mechanism that accumulates historical gradients, producing smoother, more stable, and highly generalizable feature gradients. Additionally, we introduce a dynamic soft labeling strategy that regularizes the optimization process, guiding the adversarial examples to settle in broader and flatter regions of the loss landscape, thereby mitigating overfitting. Extensive experiments demonstrate that FAGA significantly outperforms existing state-of-the-art methods.