Source-linked AI summary
Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
Yulong Cao, Chaowei Xiao, Dawei Yang, Jing Fang, Ruigang Yang, Mingyan Liu, Bo Li
TL;DR
LiDAR-based autonomous driving systems may be vulnerable to adversarial objects, but attacks must manipulate physically realizable 3D geometry through a pipeline with non-differentiable stages. The paper proposes LiDAR-Adv, evaluates it against Baidu Apollo, and reports successful digital and physical attacks, including a 71% hiding-object attack success rate for a 50cm object.
Problem
The paper asks whether adversarial attacks can compromise LiDAR-based autonomous driving systems despite 3D sensing, constrained object geometry, and non-differentiable preprocessing and post-processing.
Method
LiDAR-Adv uses a differentiable LiDAR renderer, differentiable proxy feature aggregation, and smoothness losses to optimize physically plausible adversarial objects.
Results
LiDAR-Adv misleads the Baidu Apollo system in physical experiments, and a 50cm hiding-object attack achieves a 71% attack success rate.
Takeaways & Limitations
LiDAR-based autonomous driving detection systems can be vulnerable to robust physical adversarial objects under varied positions and orientations.
Takeaways & Limitations
The initial adversarial attack demonstration considers only a single frame; multiple frames are treated as a robustness enhancement.
Abstract
from arXiv · showhide
Deep neural networks (DNNs) are found to be vulnerable against adversarial examples, which are carefully crafted inputs with a small magnitude of perturbation aiming to induce arbitrarily incorrect predictions. Recent studies show that adversarial examples can pose a threat to real-world security-critical applications: a "physical adversarial Stop Sign" can be synthesized such that the autonomous driving cars will misrecognize it as others (e.g., a speed limit sign). However, these image-space adversarial examples cannot easily alter 3D scans of widely equipped LiDAR or radar on autonomous vehicles. In this paper, we reveal the potential vulnerabilities of LiDAR-based autonomous driving detection systems, by proposing an optimization based approach LiDAR-Adv to generate adversarial objects that can evade the LiDAR-based detection system under various conditions. We first show the vulnerabilities using a blackbox evolution-based algorithm, and then explore how much a strong adversary can do, using our gradient-based approach LiDAR-Adv. We test the generated adversarial objects on the Baidu Apollo autonomous driving platform and show that such physical systems are indeed vulnerable to the proposed attacks. We also 3D-print our adversarial objects and perform physical experiments to illustrate that such vulnerability exists in the real world. Please find more visualizations and results on the anonymous website: https://sites.google.com/view/lidar-adv.
1 Introduction
The paper investigates whether adversarial attacks can compromise LiDAR-based autonomous driving systems, which differ from image-only classifiers because they directly sense the 3D environment. It introduces LiDAR-Adv, evaluates it on Apollo, and validates the attacks with 3D-printed objects.
- Motivation: LiDAR-based autonomous driving systems may be vulnerable to adversarial attacks, extending security concerns beyond image-space classifiers.The paper motivates this question because small perturbations can induce incorrect predictions in machine-learning models, while autonomous vehicles use LiDAR or RADAR to probe 3D surroundings.
- Approach: LiDAR-Adv generates physically plausible adversarial 3D objects by bridging object-shape perturbations to LiDAR scans and using differentiable proxy functions.The approach addresses non-differentiable processing and constrained perturbation spaces, then optimizes losses for smooth generated objects.
- Attack goals: The method supports hiding objects from detection and changing detected labels to specified adversarial targets.The paper compares LiDAR-Adv with an evolution-based blackbox attack.
- Evaluation: 3D-printed adversarial objects mislead the Baidu Apollo autonomous driving platform in physical experiments.Apollo is described as an industry-level platform, and the experiments target its production-level multi-stage detector.
2 Related work
Prior work established adversarial behavior in images, printable textures, 3D shapes, and raw point clouds, but LiDAR-Adv targets physically constrained object geometry against an industry-level autonomous driving platform.
- Image-space attacks: Image-space attacks include printable stickers and textures that cause detectors to misclassify stop signs.Related work also optimized 3D shapes whose surface geometry produces adversarial behavior.
- LiDAR-specific setting: LiDAR attacks cannot rely on surface textures because the sensor directly probes the 3D environment, making shape geometry the attack medium.This distinguishes the setting from attacks that manipulate image appearance.
- Evaluation setting: The victim in this work is Apollo, an industry-level autonomous driving platform containing multiple non-differentiable components rather than only an end-to-end deep-learning model.This broadens the evaluated system setting beyond a single differentiable model.
- Point-cloud attacks: Prior adversarial point-cloud work demonstrated vulnerability in a single digital model without establishing plausible reconstructible 3D surfaces or LiDAR-generated scans.LiDAR-Adv constrains points to intersections of laser beams and object surfaces.
3 LiDAR-based Detection
The LiDAR detection pipeline scans the environment into a point cloud, converts it into a structured feature map, applies a neural model, and post-processes outputs into object predictions. Several hard operations create zero gradients, limiting direct gradient-based attacks.
- LiDAR sensing: A LiDAR sensor emits laser beams, measures photon time of flight, and forms a point cloud containing 3D coordinates and intensity.The resulting scan represents reflected surface points in the surrounding environment.
- Preprocessing: The raw point cloud is transformed and filtered using an HDMap, then assigned to H × W vertical cells to form an H × W × 8 feature map.This preprocessing converts the region-of-interest scan into the representation consumed by the model.
- Preprocessing: Hard point-to-cell assignment and operations such as counting and maximum height introduce piecewise zero gradients.These operations make direct end-to-end optimization-based attacks inapplicable without additional approximations.
- Machine-learning model: A DNN processes the feature map and outputs metrics for each of the H × W cells.The model output is subsequently used by the post-processing pipeline.
- Post-processing: Post-processing clusters candidate obstacles, builds boxes, and tracks detections using model outputs and the region-of-interest point cloud.Clustering uses confidence and point-count constraints to produce obstacle candidates.
- Scope: The demonstration considers a single frame, while multi-frame handling is described as a robustness enhancement and evaluated through experiments across locations.This bounds the initial attack formulation to single-frame feasibility.
4 Generating Adversarial Object Against LiDAR-based Detection
LiDAR-Adv builds an end-to-end pipeline that makes LiDAR-based detection differentiable while constraining 3D perturbations to remain physically plausible. It supports hiding and label-changing objectives, including blackbox attacks when model parameters are unavailable.
- Methodology overview: LiDAR-Adv models the detection pipeline from a 3D object through LiDAR rendering, feature aggregation, model inference, and post-processing.The formulation is F(S) = M(Φ(R(S))), with the renderer R providing differentiability with respect to the object.
- Adversarial goals: The attack targets two goals: hiding an existing object or changing its detected label to a specified target.
- Differentiable LiDAR rendering: A differentiable LiDAR renderer intersects predefined laser rays with object meshes to generate the raw point cloud used by the detector.Depth testing retains the first surface encountered along each beam, reproducing LiDAR surface measurements.
- Differentiable feature aggregation: Trilinear proxy functions replace nondifferentiable feature aggregation with soft count, height, intensity, and non-empty features that provide gradients.The soft count distributes each point across eight neighboring grid cells using trilinear weights; the approximation can differ from the original preprocessing.
- Objective functions: The optimization combines adversarial loss with a distance loss, while vertex manipulation and smoothness constraints keep generated objects realistic.The distance formulation includes a Laplacian smoothness term and an L2 perturbation limit.
- Blackbox attack: An evolution-based method provides a blackbox attack for settings where the attacker lacks complete access to internal model parameters.
5 Experiments
The experiments demonstrate vulnerabilities in LiDAR-based detection through blackbox hiding attacks, whitebox LiDAR-Adv attacks, label changes, robustness testing, and a physical 3D-printed evaluation.
- 5.2 Vulnerability analysis: Evolution-based blackbox attacks expose LiDAR detection vulnerability by attempting to hide objects across different sizes, positions, and orientations.The evaluation uses 50 cm and 75 cm objects and 45 position-orientation pairs per object.
- 5.3 LiDAR-Adv with different adversarial goals: LiDAR-Adv achieves a 71% attack success rate for hiding a 50 cm object and produces smoother adversarial objects than evolution-based attacks.Its attack success rate is consistently higher than the evolution-based blackbox baseline.
- 5.3 LiDAR-Adv with different adversarial goals: LiDAR-Adv can also change an object's detected label, including mis-detection as a “Pedestrian”.The experiments consider different initial shapes and target labels.
- 5.4 LiDAR-Adv on generating robust physical adversarial objects: Sampling positions and orientations during optimization yields adversarial objects that retain hiding behavior across controlled and unseen physical settings.The reported unseen-setting performance can exceed performance in the controlled environment.
- 5.4 LiDAR-Adv on generating robust physical adversarial objects: In physical testing, a 3D-printed adversarial object is not detected in 36 moving-car frames, whereas a box is detected in 12 of 18 frames.The traces are evaluated on Baidu Apollo using LiDAR data collected from a moving vehicle.
6 Conclusion
The paper concludes that LiDAR-based autonomous-driving detection is vulnerable to adversarial attacks and that LiDAR-Adv can generate physically robust objects that attack Baidu Apollo across positions and orientations.
- 6 Conclusion: LiDAR-based autonomous-driving detection systems are vulnerable to adversarial attacks.The conclusion frames this vulnerability as a security concern for LiDAR systems in autonomous vehicles.
- 6 Conclusion: LiDAR-Adv integrates a proxy differentiable approximator to generate robust physical adversarial objects.The differential renderer simulates LiDAR ray intersections with object surfaces to produce physically grounded point clouds.
- 6 Conclusion: The generated adversarial objects attack Baidu Apollo at different positions and orientations and are smoother than those from evolution-based attacks.The renderer uses predefined rays derived from LiDAR specifications or captured background point clouds.
B.1 LiDAR perception system
The LiDAR perception system transforms raw point clouds into feature maps, processes them with a DNN, and aggregates outputs for object detection. A tanh proxy reduces approximation errors relative to a trilinear proxy.
- Gradient proxy functions: The tanh approximator reduces feature and model-output errors compared with the trilinear approximator.The comparison concerns the count feature and objectness metric.
D.1 Changing label
LiDAR-Adv generates adversarial objects from different pristine meshes and targets alternative labels. The experiments report high attack success across starting shapes, while the supplied table summary reports 100% success for the listed model and Apollo evaluations.
- Changing label: LiDAR-Adv tests three pristine meshes—cuba, sphere, and tetrahedron—against the other four labels besides the original prediction.
- Changing label: The method has a high chance of producing the target label regardless of the pristine mesh used as its starting point.
- Robustness: 100% success rate is reported for both the model and Apollo across the listed angle evaluations.The table summary marks every listed angle for both systems with a check mark, indicating no object detected.
D.1.1 LiDAR-Adv on generating robust physical adversarial objects
LiDAR-Adv generates robust adversarial objects across multiple angles and positions before physical testing. The reported objects remain smooth and plausible while achieving successful attacks in the evaluated settings.
- Robustness evaluation: The evaluation tests adversarial objects across different angles and positions to assess robustness before 3D printing.
- Qualitative results: Qualitative views show the adversarial object causing detection failure at three evaluated angles, unlike the benign cube.
- Different angles: 100% attack success is reported across nine angles on both the approximate model and the Apollo system.The result is presented as evidence that the differentiable proxy functions transfer adversarial behavior to Apollo.
- Different positions: The adversarial object remains smooth and reconstructable from multiple views while attacking nine positions simultaneously.
- Different positions: 100% success is reported for the robust adversarial object across the nine evaluated positions.
D.2 Physical experiments
The physical experiment 3D-prints the generated object at full scale and tests it with a LiDAR-equipped car and dashcams on a road. A same-sized benign box provides the comparison condition.
- Experimental setup: The generated adversarial object is 3D-printed at 1:1 scale for the physical experiment.
- Experimental setup: A car mounted with LiDAR and dashcams drives by the object while collecting scanned point clouds and reference videos.
- Comparison condition: A same-sized benign box is placed at the same location and tested with the same collection protocol for comparison.