Thanks for your comments and encouragements! The success rates of the attacks are not really emphasized---we only show that they work. They provide other benef

Thanks for your comments and encouragements! The success rates of the attacks are not really emphasized---we only show that they work. They provide other benefits like robustness against point removal defenses. The attacks are optimized for different criterion. The sticks attack is supposed to be easy to construct, at the cost of perceptibility. The distributional attack is more geared towards imperceptibility. Indeed, we do bound the perceptibility of the sticks and sinks attacks, just with different metrics. You can even argue that the number of sticks we generate is a measure of perceptibility. Compared to other papers in terms of visual perceptibility, our attacks are not that crazy. Of course, human perception is the true metric, and I think more work must be done on quantifying perceptibility in 3D. This paper is the first step, and I mainly wanted to show that there are factors other than perceptibility that we care about.