Response to Reviewer Yqki [2/3]
> **Q3:** 3D face recognition also need to be considered.
**Re:** We value your insightful and constructive feedback and fully concur with your suggestion to conduct experiments in more practical scenarios. We present the UMT performance on face recognition in the Table R5 below using Basel Face Model 2017 [1] to generate 3D point cloud face scans. Our experimental setup for 3D face BFM 2017 is consistent with [2], which involves generating 100 classes of face scans (each of them contains 50 point clouds), dividing the whole 5000 face data into training and test part, containing 4000 and 1000 data respectively, and then randomly choosing 1024 points for each point clouds. It can be seen that UMT is still effective in this scenario, which is also because the class-wise transformation causes the model to overfit the transformation-based shortcut of the training data, making it difficult to generalize to clean test data.
**Table R5:** Evaluation of UMT on face recognition using BFM2017-generated 3D point cloud face dataset.
| PointNet | Clean baseline | UMT(k=1, $\mathcal{R}$) | UMT(k=2, $\mathcal{R}\mathcal{S}$) | UMT(k=3, $\mathcal{R}\mathcal{S}\mathcal{W}$) | UMT(k=4, $\mathcal{R}\mathcal{S}\mathcal{W}\mathcal{H}$) |
| :---------------: | -------------- | ----------------------- | ---------------------------------- | --------------------------------------------- | -------------------------------------------------------- |
| Test accuracy (%) | 98.10 | 0.81 | 1.11 | 0.91 | 1.01 |
[1] *Morphable face models-an open framework.* International Conference on Automatic Face & Gesture Recognition'18
[2] *Toward availability attacks in 3D point clouds.* ICML'24
> **Q4:** The performance of proposed method against rotation/scale/SE(3) equivariant models.
**Re:** We appreciate your insight on this matter. In our original paper, we have indeed discussed the robustness of UMT against rotation/scaling invariant models. The results for RIConv++ (rotation invariant) and 3DGCN (scaling invariant) networks in Table 1, as well as RIConv, LGR-Net (rotation invariant), and 3DGCN in Table 4, demonstrating that these invariant networks can indeed defend against class-wise rotation and scaling. It is worth noting that these networks, which are invariant to a single transformation, cannot defend against UMT formed by a combination of multiple transformations. Thus, it appears that networks like SE(3), which are invariant to multiple transformations in space, can potentially overcome UMT. Therefore, following your insightful advice, we included experimental results for the SE(3) network SE (3)-Transformer [1] in the following Table R6.
**Table R6:** Test accuracy results (%) of SE(3) equivariant model SE (3)-Transformer using UMT and clean training set.
| Clean baseline | 49.07 |
| :----------------------------------------------------------: | :-------: |
| **UMT(k=3, $\mathcal{R}\mathcal{S}\mathcal{W}$)** | **17.51** |
| **UMT(k=4, $\mathcal{R}\mathcal{S}\mathcal{W}\mathcal{H}$)** | **13.55** |
However, it can be seen that SE (3)-Transformer cannot defend against UMT (k=3, $\mathcal{R}\mathcal{S}\mathcal{W}$) and UMT(k=4, $\mathcal{R}\mathcal{S}\mathcal{W}\mathcal{H}$). This is because existing transformation-invariant networks, even including SE(3) invariant networks [1], are designed only for rigid transformations (rotation, scaling, reflection, and translation, as shown in Fig. 7 in the original paper). There are currently no invariant networks proposed for non-rigid transformations like shear and twisting. Therefore, if a data protector wants UMT to be more robust, they can including non-rigid class-wise transformations to defeat existing rigid transformation-invariant networks. Of course, we also acknowledge that more robust invariant networks may be developed in the future, but it is exactly for this reason that the introduction of UMT will advocate for the design of more robust 3D point cloud networks, which is also where the value of our work lies.
[1] *SE(3)-Transformers: 3D Roto-Translation Equivariant Attention Networks*. NeurIPS'20