Abstract: Adversarial attacks on deep local feature matching models of 3D point clouds play a critical role to evaluate and improve their adversarial robustness.Three adversarial attack methods are proposed based on adversarial points,i.e.,adversarial point perturbation by changing the coordinates of all points in the partial point cloud to be matched;adversarial point addition by adding points to the positions of key points in a pre-calculated saliency map and then applying perturbation;adversarial point deletion by moving key points of the saliency map to the center of the shapes to simulate deletion.Extensive experimental results on the 3DMatch dataset show that all three adversarial attack methods can fool the DIP and SpinNet models.Besides,it is observed that the attack performance is positively related to the perturbation size.Under the requirement of maintaining imperceptibility,with the increase of disturbance,the attack performance improves,e.g.,the feature matching recall of the DIP model can be reduced from 100%to 2%after the attack.