3D point cloud classification is a fundamental task in safety-critical applications such as autonomous driving, robotics, and augmented reality. However, recent studies reveal that point cloud classifiers are vulnerable to structured adversarial perturbations and geometric corruptions, posing risks to their deployment in safety-critical scenarios. Existing certified defenses limit point-wise perturbations but overlook subtle geometric distortions that preserve individual points yet alter the overall structure, potentially leading to misclassification. In this work, we propose FreqCert, a novel certification framework that departs from conventional spatial domain defenses by shifting robustness analysis to the frequency domain, enabling structured certification against global L2-bounded perturbations. FreqCert first transforms the input point cloud via the graph Fourier transform (GFT), then applies structured frequency-aware subsampling to generate multiple sub-point clouds. Each sub-cloud is independently classified by a standard model, and the final prediction is obtained through majority voting, where sub-clouds are constructed based on spectral similarity rather than spatial proximity, making the partitioning more stable under L2 perturbations and better aligned with the object's intrinsic structure. We derive a closed-form lower bound on the certified L2 robustness radius and prove its tightness under minimal and interpretable assumptions, establishing a theoretical foundation for frequency domain certification. Extensive experiments on the ModelNet40 and ScanObjectNN datasets demonstrate that FreqCert consistently achieves higher certified accuracy and empirical accuracy under strong perturbations. Our results suggest that spectral representations provide an effective pathway toward certifiable robustness in 3D point cloud recognition.

翻译：三维点云分类是自动驾驶、机器人和增强现实等安全关键应用中的基础任务。然而，近期研究表明，点云分类器易受结构化对抗扰动和几何损坏的影响，这对其在安全关键场景中的部署构成了风险。现有的认证防御方法主要限制逐点扰动，但忽略了保持单个点不变却改变整体结构的细微几何畸变，这可能导致误分类。本文提出FreqCert，一种新颖的认证框架，通过将鲁棒性分析转移到频域，摆脱传统空间域防御的局限，实现了针对全局L2有界扰动的结构化认证。FreqCert首先通过图傅里叶变换（GFT）将输入点云转换到频域，然后应用结构化频率感知子采样生成多个子点云。每个子点云由标准模型独立分类，最终预测通过多数投票获得，其中子点云的构建基于频谱相似性而非空间邻近性，使得划分在L2扰动下更稳定，且更符合物体的内在结构。我们推导了认证L2鲁棒性半径的闭式下界，并在最小且可解释的假设下证明了其紧致性，为频域认证奠定了理论基础。在ModelNet40和ScanObjectNN数据集上的大量实验表明，FreqCert在强扰动下始终获得更高的认证准确率和经验准确率。我们的结果表明，频谱表示为三维点云识别中可认证鲁棒性提供了有效途径。