Multimodal Robust Prompt Distillation for 3D Models

Updated 3 July 2026

The paper introduces MRPD, a teacher-student framework that distills multimodal knowledge into efficient prompts for adversarially robust 3D point cloud classification.
It employs three frozen teachers (vision, 3D, and text) and confidence-gated contrastive distillation to selectively transfer robust features during training.
Experiments on ModelNet40 and ScanObjectNN show that MRPD boosts both clean accuracy and robustness against diverse white-box and black-box attacks without increasing inference cost.

Multimodal Robust Prompt Distillation (MRPD) is a teacher-student framework for adversarially robust 3D point cloud classification that learns lightweight prompts by aligning a student point cloud model with robust embeddings from three frozen teachers: a vision model processing depth projections, a high-performance 3D model, and a text encoder. Its defining claim is efficiency at deployment: because the distillation is confined to training, the teachers are discarded at inference and there is no additional computational cost at test time. In reported experiments on ModelNet40 and ScanObjectNN, MRPD improves both clean-data performance and robustness against diverse white-box and black-box attacks while preserving the original student architecture (Gu et al., 26 Nov 2025).

1. Problem domain and conceptual scope

MRPD addresses adversarial robustness for 3D point cloud models, particularly VLM-guided point cloud systems in the PointCLIP family. The motivating threat model includes point-wise perturbation attacks, point addition attacks, point removal attacks, and transfer-based black-box attacks. The framework is explicitly designed against two limitations attributed to prior 3D defenses: high computational overhead and weak generalization across attack families (Gu et al., 26 Nov 2025).

The framework is situated within a broader multimodal prompting and robustness literature, but its target problem is specific. Earlier work on missing-modality robustness in vision-language classification used missing-aware prompts in frozen multimodal transformers and trained about $0.2\%$ prompt parameters relative to full ViLT finetuning (Lee et al., 2023). Related work later replaced missing-aware prompts with modality-specific prompts, reducing prompt scaling from $2^M-1$ to $M$ and improving robustness under train-test mismatch in missing-modality patterns (Jang et al., 2023). MRPD differs from those lines in that it targets adversarially robust 3D point cloud classification rather than incomplete-modality vision-language recognition (Gu et al., 26 Nov 2025).

A recurrent source of confusion is the acronym itself. In another paper, MRPD denotes “MRI Reconstruction by Prompting a large latent Diffusion model,” a method for undersampled MRI reconstruction rather than multimodal robust prompt distillation (Gao et al., 2024). In the present sense, MRPD refers specifically to “Multimodal Robust Prompt Distillation for 3D Point Cloud Models” (Gu et al., 26 Nov 2025).

2. Teacher-student architecture and prompt parameterization

MRPD is implemented on top of a PointCLIP V2-style architecture. The student is a point cloud encoder equipped with learned point prompts, while the text side also uses learned prompt vectors. The trainable parameters are the point prompt $\theta_p$ , the text prompt $\theta_t$ , and the dynamic weighting parameters $\lambda_I,\lambda_P,\lambda_T$ ; the image encoder $f_I$ , the point teacher $f_P$ , the text encoder backbone $f_T$ , and the student backbone outside the prompts remain frozen (Gu et al., 26 Nov 2025).

Component	Construction	Role
Image teacher	Frozen image encoder $f_I$ on multi-view depth projections $2^M-1$ 0	View-invariant, relatively stable visual guidance
Point teacher	Frozen high-performance 3D encoder $2^M-1$ 1	Geometric anchor for clean shape structure
Text teacher	Frozen text encoder $2^M-1$ 2 with learnable context $2^M-1$ 3	Semantic class space and classifier

The image teacher encodes depth projections of a point cloud $2^M-1$ 4 as

$2^M-1$ 5

The point teacher produces

$2^M-1$ 6

The text side defines a learnable context

$2^M-1$ 7

concatenates it with each class name $2^M-1$ 8,

$2^M-1$ 9

and then computes class embeddings

$M$ 0

The prompt inventory is intentionally small. The best reported configuration uses 10 point prompt tokens and 3 text prompt tokens. This compact parameterization is central to the framework’s claim that robustness can be transferred during training without adding inference-time modules (Gu et al., 26 Nov 2025).

3. Confidence-gated multimodal distillation

The distinctive mechanism in MRPD is confidence-gated contrastive distillation. Rather than distilling every teacher signal unconditionally, the framework first evaluates whether a teacher is reliable for each sample by scoring teacher features against the text-defined class space. For one reference modality, the confidence logits are

$M$ 1

where $M$ 2 is a temperature parameter (Gu et al., 26 Nov 2025).

A binary validity mask is then defined samplewise: $M$ 3 Only selected samples with $M$ 4 participate in the distillation loss for that teacher. On the selected subset, the student-reference similarity matrix is

$M$ 5

and the confidence-gated contrastive loss is

$M$ 6

This loss is instantiated for the image, point, and text teachers: $M$ 7 The final multimodal objective uses learnable uncertainty-style weights: $M$ 8

Training uses a mixed-data diet of clean and PGD-attacked point clouds, but inference discards all three teachers. At test time, only the prompted student and prompted text embeddings remain: $M$ 9

$\theta_p$ 0

$\theta_p$ 1

This training-only distillation design is the basis for the framework’s zero-overhead deployment claim (Gu et al., 26 Nov 2025).

4. Experimental performance

MRPD is evaluated on ModelNet40 and ScanObjectNN for 3D point cloud classification. Data preprocessing uses Farthest Point Sampling and normalization to the unit sphere, with 1024 points per object on ModelNet40 and 2048 on ScanObjectNN. Training is run for 100 epochs with AdamW, learning rate $\theta_p$ 2, weight decay $\theta_p$ 3, and cosine annealing (Gu et al., 26 Nov 2025).

The attack suite covers white-box and black-box settings. White-box evaluation includes PGD, Perturb, KNN, ADD-CD, ADD-HD, AOF, Drop-200, and AdvPC. Black-box attacks are generated on a surrogate PointNet++ model and transferred to the target system (Gu et al., 26 Nov 2025).

Dataset	White-box: Clean / Avg. R	Black-box: Clean / Avg. R
ModelNet40	90.52 / 72.58	90.52 / 65.72
ScanObjectNN	78.80 / 67.39	78.80 / 67.47

On ModelNet40 under white-box attack, MRPD reports 89.14 on PGD, 80.79 on Perturb, 87.88 on KNN, 81.36 on ADD-CD, 68.31 on ADD-HD, 54.86 on AOF, 78.32 on Drop-200, and 39.99 on AdvPC, with clean accuracy 90.52 and average robustness 72.58. On ScanObjectNN under white-box attack, it reports 76.13 on PGD, 72.24 on Perturb, 72.52 on KNN, 74.74 on ADD-CD, 57.08 on ADD-HD, 60.06 on AOF, 77.72 on Drop-200, and 48.65 on AdvPC, with clean accuracy 78.80 and average robustness 67.39 (Gu et al., 26 Nov 2025).

Relative to adversarial training, MRPD improves ModelNet40 average white-box robustness from 65.89 to 72.58 while also slightly improving clean accuracy from 89.95 to 90.52. On ScanObjectNN, adversarial training retains higher clean accuracy, 83.48 versus 78.80, but MRPD increases average white-box robustness from 64.18 to 67.39. The paper also reports zero additional deploy-time parameters in its comparison table, reinforcing the claim that robustness is transferred during training rather than via test-time defenses (Gu et al., 26 Nov 2025).

5. Ablation studies and internal behavior

The prompt components are individually important, but their combination is much stronger than either alone.

Setting	ModelNet40 Avg. R	ScanObjectNN Avg. R
Baseline	21.10	9.99
+ Text Prompt	52.37	44.56
+ Point Prompt	55.16	35.67
Full MRPD	72.58	67.39

This decomposition shows that both prompt types matter and that their joint use is not merely additive. On ScanObjectNN, the text prompt contributes more than the point prompt in isolation, which the authors interpret as evidence that semantic regularization is especially valuable in noisy real-world data (Gu et al., 26 Nov 2025).

Teacher ablations further indicate complementarity. On ModelNet40 white-box attacks, full MRPD reaches 72.58 average robustness, while removing the point teacher reduces it to 70.38 and removing the image teacher reduces it to 70.24. The point teacher most strongly supports ADD-HD and AdvPC, whereas the image teacher most strongly supports Perturb, KNN, and AOF. Confidence gating is also beneficial: removing the confidence-gated contrastive mechanism reduces ModelNet40 average robustness from 72.58 to 70.99, although PGD rises slightly from 89.14 to 89.47 (Gu et al., 26 Nov 2025).

Dynamic weights clarify how the model allocates trust across modalities. The learned weights are reported as approximately $\theta_p$ 4 for the point teacher, $\theta_p$ 5 for the image teacher, and $\theta_p$ 6 for the text teacher. This indicates that the model relies heavily on the point and image teachers while using the text teacher mainly as a low-weight semantic regularizer. Prompt-size ablation finds the best configuration at 10 point prompt tokens and 3 text prompt tokens; larger prompt counts, such as $\theta_p$ 7 or $\theta_p$ 8, degrade average robustness (Gu et al., 26 Nov 2025).

The representation analysis is consistent with the quantitative results. Under attack, the undefended model’s feature space collapses into overlapping clusters, whereas MRPD preserves compact and separated class clusters in t-SNE visualizations (Gu et al., 26 Nov 2025).

6. Relation to adjacent work, misconceptions, and scope

MRPD belongs to a broader family of multimodal robustness methods, but it combines ingredients that are usually separated in the literature. Robust prompting under missing modalities has been explored through case-specific prompts in frozen multimodal transformers (Lee et al., 2023) and through modality-specific prompts with orthogonality regularization (Jang et al., 2023). Robust distillation without prompts appears in segmentation, where a full-modality teacher supervises a student under random modality dropout using hybrid prototype distillation and representation regularization (Tan et al., 19 May 2025), and in CLIP finetuning, where a Weighted Moving Average teacher provides persistent self-distillation during robust multimodal adaptation (Asadollahzadeh et al., 28 May 2026). MRPD differs by explicitly distilling robust multimodal knowledge into lightweight point and text prompts for adversarially robust 3D classification (Gu et al., 26 Nov 2025).

A second misconception is to equate prompt distillation with generic feature compression. In few-shot VQA, “Meta-Adaptive Prompt Distillation” compresses task-relevant visual information into soft prompts via an attention-mapper, but it does not use a teacher-student multimodal robustness objective (Gupta et al., 7 Jun 2025). MRPD, by contrast, is explicitly teacher-student, explicitly multimodal, and explicitly optimized for adversarial robustness in 3D point clouds (Gu et al., 26 Nov 2025).

The method’s current scope is narrow but concrete. It is demonstrated mainly on classification, and the paper identifies detection and segmentation as future extensions. A plausible implication is that MRPD should be understood less as a generic recipe for all multimodal prompting and more as a practical paradigm for 3D robustness transfer: train with multimodal teachers, retain only the prompted student, and pay no extra inference cost afterward. Within that scope, the framework presents a specific answer to a persistent design problem in robust 3D learning: how to exploit multimodal supervision without inheriting the deployment cost of multimodal defenses (Gu et al., 26 Nov 2025).