Physically Realizable Adversarial Examples for LiDAR Object Detection (2004.00543v2)

Abstract: Modern autonomous driving systems rely heavily on deep learning models to process point cloud sensory data; meanwhile, deep models have been shown to be susceptible to adversarial attacks with visually imperceptible perturbations. Despite the fact that this poses a security concern for the self-driving industry, there has been very little exploration in terms of 3D perception, as most adversarial attacks have only been applied to 2D flat images. In this paper, we address this issue and present a method to generate universal 3D adversarial objects to fool LiDAR detectors. In particular, we demonstrate that placing an adversarial object on the rooftop of any target vehicle to hide the vehicle entirely from LiDAR detectors with a success rate of 80%. We report attack results on a suite of detectors using various input representation of point clouds. We also conduct a pilot study on adversarial defense using data augmentation. This is one step closer towards safer self-driving under unseen conditions from limited training data.

Examination of Adversarial Attacks on LiDAR Object Detection

This paper focuses on the generation of physically realizable adversarial examples specifically targeting LiDAR-based object detection systems utilized in autonomous driving. While adversarial attacks have been extensively researched in the context of image data, analogous studies concentrating on LiDAR point clouds are notably scarce. The research presented aims to bridge this gap by demonstrating a method to create adversarial mesh objects capable of significantly deceiving LiDAR object detectors.

Methodology

The authors propose a novel approach to adversarial attacks in the 3D space that targets the perception systems of autonomous vehicles which rely heavily on LiDAR sensors. This work introduces universal adversarial objects, specifically crafted to render vehicles undetectable when positioned on their rooftops. The adversarial examples are created using mesh objects designed in such a way that they affect the point cloud data processed by LiDAR sensors.

Through a series of methodological steps, the authors construct 3D adversarial objects via mesh parameterization, ensuring these perturbations remain within physically feasible limits. The paper details a strategy that involves rendering the mesh into point clouds, which are integrated with real-world vehicle point cloud data. The adversarial mesh is optimized using an objective function that minimizes detection confidence, taking into account real-world signal processing constraints of LiDAR systems.

Results and Evaluation

The paper evaluates the success rate of these attacks on multiple LiDAR object detectors, such as PIXOR, PointRCNN, and PointPillar, exploiting differences in their input representations and learning architectures. Notably, the adversarial objects achieved an 80% success rate at deceiving a strong LiDAR detector by making host vehicles invisible, emphasizing the vulnerabilities present in current self-driving technologies. Additionally, the paper explores both white-box and black-box attack scenarios, finding the black-box approach yields competitive performance without access to internal model parameters.

Implications

The findings from this research hold significant implications for the deployment of autonomous driving systems, highlighting critical vulnerabilities due to adversarial attacks in the 3D perception domain. This has prompted considerations for more robust adversarial defenses and augmented detector training protocols. The authors propose adversarial training and random data augmentation as viable defenses, thereby significantly reducing attack success rates.

Future Directions

The paper suggests several future research avenues, including enhanced mesh parameterization techniques and exploring other input dimensions that may improve model robustness against adversarial threats. Furthermore, advancing adversarial defense strategies constitutes a critical area of paper, necessary for ensuring the reliability and safety of self-driving vehicle technology.

In summation, this paper provides a comprehensive overview of constructing physically realizable adversarial examples for LiDAR sensors and their implications on the security of autonomous driving systems. The proposed strategies invite further exploration into the development of robust perception systems resilient to adversarial attacks.