Explaining 3D Point Cloud Semantic Segmentation Models Through Adversarial Attacks

Although deep learning methods for the semantic segmentation of 3D point clouds have been extensively researched, there is limited research on explainable artificial intelligence methods for this domain. Therefore, we extend the Critical Traversal Attack (CTA) approach previously proposed for 3D point cloud classification models to the semantic segmentation task. This approach aims to alter the predictions of a model by perturbing salient input points, which can provide counterfactual explanations. To transfer CTA to semantic segmentation, we reformulate its loss function and success criterion so that the prediction probability of all points belonging to a target class is decreased. Through this method, our study investigates the following aspects of 3D point cloud segmentation models: 1) Sensitivity to perturbations in different input channels. Our results show that the studied architectures are more vulnerable to perturbations in color than spatial features, with color changes for very few points already leading to successful attacks. We further study the per-color-channel sensitivity, finding that models tend to be more sensitive to perturbations in the green channel and more robust to perturbations in the red channel. 2) Degree of perturbation needed to alter the semantic segmentation results for a target class. We find that the degree of perturbation needed for spatial features is considerably large for most architectures, whereas a much smaller degree of perturbation is needed for the color features. 3) Transferability of adversarial attacks across deep learning architectures. Our experiments indicate that, in general, adversarial attacks display mid-to-low transferability for both spatial and color features.