PaperlayerView exact revision on arXiv

Source-linked AI summary

Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks

Yulong Cao*, Ningfei Wang*, Chaowei Xiao*, Dawei Yang*, Jin Fang, Ruigang Yang, Qi Alfred Chen, Mingyan Liu, Bo Li

arXiv:2106.09249v1cs.CRcs.CVcs.LG

TL;DR

The paper addresses the lack of security analysis for multi-sensor-fusion AD perception when camera and LiDAR are attacked simultaneously. It introduces an optimization-based, physically realizable adversarial 3D-object attack that handles non-differentiable sensing and LiDAR preprocessing. The attack exceeds 90% success across object types and MSF, transfers across algorithms, works after 3D printing, and causes a 100% collision rate in simulation.

  • Problem

    Prior AD-perception security studies target camera or LiDAR alone, leaving the security guarantee of multi-sensor fusion under simultaneous attacks unexamined.

  • Method

    MSF-ADV optimizes the shape of a 3D-printed object to perturb camera and LiDAR inputs while addressing non-differentiable sensing and cell-level LiDAR features.

  • Results

    The attack achieves over 90% success across object types and MSF, remains stealthy, robust and transferable, is physically realizable after 3D printing, and causes a 100% vehicle collision rate in simulation.

  • Takeaways & Limitations

    Simultaneously attacking camera and LiDAR can challenge MSF's basic security assumption in AD perception.

  • Takeaways & Limitations

    End-to-end attack impacts were evaluated in a production-grade simulator rather than on a real autonomous vehicle, and effectiveness for DNN-based MSF remains unclear.

Abstract

from arXiv · show

In Autonomous Driving (AD) systems, perception is both security and safety critical. Despite various prior studies on its security issues, all of them only consider attacks on camera- or LiDAR-based AD perception alone. However, production AD systems today predominantly adopt a Multi-Sensor Fusion (MSF) based design, which in principle can be more robust against these attacks under the assumption that not all fusion sources are (or can be) attacked at the same time. In this paper, we present the first study of security issues of MSF-based perception in AD systems. We directly challenge the basic MSF design assumption above by exploring the possibility of attacking all fusion sources simultaneously. This allows us for the first time to understand how much security guarantee MSF can fundamentally provide as a general defense strategy for AD perception. We formulate the attack as an optimization problem to generate a physically-realizable, adversarial 3D-printed object that misleads an AD system to fail in detecting it and thus crash into it. We propose a novel attack pipeline that addresses two main design challenges: (1) non-differentiable target camera and LiDAR sensing systems, and (2) non-differentiable cell-level aggregated features popularly used in LiDAR-based AD perception. We evaluate our attack on MSF included in representative open-source industry-grade AD systems in real-world driving scenarios. Our results show that the attack achieves over 90% success rate across different object types and MSF. Our attack is also found stealthy, robust to victim positions, transferable across MSF algorithms, and physical-world realizable after being 3D-printed and captured by LiDAR and camera devices. To concretely assess the end-to-end safety impact, we further perform simulation evaluation and show that it can cause a 100% vehicle collision rate for an industry-grade AD system.

I. INTRODUCTION

This paper introduces the first security study of multi-sensor-fusion perception in autonomous driving and challenges the assumption that attacking all fusion sources simultaneously is infeasible. It develops a physical-world adversarial 3D-object attack and evaluates its effectiveness, robustness, stealthiness, transferability, and safety impact.

  • Motivation: Prior AD-perception attacks target camera or LiDAR alone, whereas production systems commonly fuse both sources for higher accuracy and robustness.MSF security had not been studied in practical AD settings under simultaneous attacks on its perception sources.
  • Attack Design: MSF-ADV uses a manipulable adversarial 3D object whose shape perturbs LiDAR point positions and camera pixel values simultaneously.The object can be placed on a roadway and produced through modern 3D-printing services.
  • Attack Design: The optimization-based pipeline differentiably renders attack-influenced camera images and LiDAR point clouds while approximating non-differentiable cell-level LiDAR features.It starts from a normal object mesh and changes vertex positions; point-inclusion properties support differentiable derivation of aggregated features.
  • Evaluation: Over 91% success rates were achieved across three object types and MSF algorithms evaluated in 100 KITTI driving scenarios per object type.The evaluation used MSF algorithms from the open-source Baidu Apollo and Autoware.AI full-stack AD systems.
  • Evaluation: The attack remained stealthy, achieved over 95% average success rates across victim positions and angles, and transferred across MSF algorithms with around 75% average transfer success.These findings were reported alongside evaluations of representative industry-grade MSF systems.
  • Safety Impact: 3D-printed objects evaded LiDAR detection in 99.1% of 108 frames, evaded both LiDAR and camera detection at 85-90% of 20 sampled positions, and caused a 100% vehicle collision rate in simulation.The collision result used an adversarial traffic cone in 100 Apollo simulator runs.

II. BACKGROUND

MSF-based AD perception fuses camera and LiDAR information to improve detection robustness, while relying on at least one perception source remaining correct. This paper examines whether simultaneously attacking both sources can defeat that assumption.

  • MSF design principle and basic assumption: MSF combines camera and LiDAR perception to leverage complementary texture and depth information for higher accuracy and robustness.Cameras provide texture but not direct depth, whereas LiDAR provides ranging information but limited texture information.
  • MSF design principle and basic assumption: The basic MSF assumption is that at least one perception source generally remains able to provide correct results and correct the fused output.The paper targets the case where all perception sources are attacked simultaneously, because an unattacked source could otherwise defeat the attack.
  • Representative MSF algorithm design: State-of-the-art MSF algorithms process camera and LiDAR inputs with perception networks before fusing their results using DNNs or hard-coded rules.Rule-based fusion is generally applied late, while DNN-based fusion may occur at late or intermediate stages.
  • Representative MSF algorithm design: MSF systems typically preprocess camera images and LiDAR point clouds through transformations, ROI filtering, and aggregated-feature extraction to reduce input size and runtime cost.These operations prepare the modality-specific inputs before fusion.
  • Security context: Prior physical-world AD perception attacks target camera-only or LiDAR-only systems, leaving MSF-based perception largely unexamined.The paper frames MSF security as a gap because production high-level systems commonly use camera-LiDAR fusion.
  • Threat model: The threat model assumes a white-box attacker with full knowledge of the victim MSF algorithm who can collect target-road camera images and LiDAR point clouds.The attacker may obtain a model by purchasing, renting, or reverse engineering a victim system, or target open-source MSF algorithms.

B. Design Challenges

The attack must use one physical vector that affects both camera and LiDAR, remain differentiable through sensing and preprocessing, and produce a deployable, stealthy object. MSF-ADV addresses these challenges with shape-manipulated adversarial 3D objects and differentiable approximations.

  • C1. Joint attack vector: C1 is the lack of a single physical-world attack vector effective against both camera- and LiDAR-based perception.Texture changes such as stickers affect cameras but not LiDAR shape measurements, while laser spoofing has been studied for LiDAR rather than camera perception.
  • C2. Differentiable sensing: C2 requires differentiably synthesizing physically consistent attack impacts on camera images and LiDAR point clouds during optimization.Thousands of optimization iterations make repeatedly collecting real attack-influenced sensor data impractical.
  • C3. Non-differentiable preprocessing: C3 arises because point inclusion in LiDAR cells is discontinuous, making commonly used cell-level aggregated features non-differentiable.The paper identifies this as an unaddressed obstacle to effective optimization for LiDAR preprocessing.
  • Design overview: MSF-ADV uses an adversarial 3D object whose shape changes alter both LiDAR point positions and camera pixel values.The object is designed to introduce simultaneous perturbations into both fusion sources.
  • Adversarial 3D object: The adversarial object is designed to be 3D-printable and stealthy by mimicking ordinary worn or broken traffic objects while constraining shape changes.The paper intentionally excludes texture manipulation because it can reduce stealthiness and create printability issues.
  • Causing road safety threats: A small object such as a cone or rock can be filled with dense material to increase crash severity while remaining easy to deploy.The paper gives examples exceeding 100 kg when filled with aluminum or other heavy material.
  • Optimization-based adversarial 3D object generation: The method starts from a normal 3D mesh and optimizes its vertex positions, while differentiable rendering synthesizes camera images and LiDAR point clouds.It further derives differentiable approximations for cell-level aggregated features from the point-inclusion property.

B. MSF-ADV Methodology Overview

MSF-ADV generates adversarial 3D objects by optimizing vertex positions so the MSF system fails to detect them while preserving physical realizability. The pipeline applies transformations, differentiable rendering and preprocessing approximations, then iteratively updates the object using gradients.

  • Problem formulation: MSF-ADV formulates adversarial-object generation as an optimization problem over the adversarial mesh and its vertex positions.The objective combines adversarial and realizability losses, balanced by λ.
  • Objective and optimization: The adversarial loss minimizes detection confidence so the MSF algorithm fails to detect the adversarial object.The loss is computed from MSF outputs or rule-based fusion decisions, depending on the system.
  • Optimization process: Expectation over transformation samples rotations and position shifts to improve robustness across environmental variation.Each transformed object is rendered with target-road LiDAR and camera backgrounds before loss calculation.
  • Optimization process: Differentiable rendering and preprocessing approximation convert attack-influenced point clouds and images into MSF input features for gradient optimization.The pipeline feeds these features through the MSF algorithm and extracts gradients with respect to adversarial vertex positions.
  • Preprocessing approximation: Soft point-inclusion enables differentiable derivation of the cell-level aggregated features used by LiDAR-based object detectors.Table I identifies these features as commonly used in state-of-the-art LiDAR detection models.

C. Differentiable Rendering

The method makes camera and LiDAR effects differentiable, then approximates discontinuous cell-level point inclusion to derive LiDAR features. A tanh-based approximation more closely matches ground truth than the trilinear alternative.

  • Differentiable rendering: Differentiable ray casting and neural rendering generate attack-influenced LiDAR point clouds and camera images in aligned sensor coordinates.A calibration matrix transforms the object from the LiDAR coordinate system into the camera coordinate system.
  • Preprocessing challenge: Cell-level feature computation is challenging because point inclusion is discontinuous, yet these aggregated features are widely used in LiDAR perception.Addressing this step is necessary to preserve the generality of the attack method.
  • Soft point-inclusion: Soft point-inclusion estimates a point’s membership across its 8 nearest 3D cells and serves as the basis for differentiable feature derivation.The method interprets interpolated values as point-inclusion probabilities.
  • Approximation accuracy: Tanh approximation assigns the point-inclusion probability of c7 as 1.0, matching the ground-truth value more accurately than trilinear approximation.The approximation reduces the gap caused by the distance function’s nondifferentiability.
  • Approximation evaluation: For the count feature, trilinear and tanh-derived values are compared with ground-truth counts using grayscale BEV heatmaps.The figure caption identifies GT as the ground-truth count value.

E. Objective Function Design

MSF-ADV combines detection-evasion, physical realizability, stealthiness, and robustness objectives. These objectives target undetected adversarial objects that can be printed, remain visually similar to benign objects, and persist across victim viewpoints.

  • Adversarial loss: The adversarial loss minimizes the confidence of regions containing the adversarial object, supporting evasion across DNN-based and rule-based MSF.For DNN-based fusion, confidence is extracted directly from the MSF output.
  • Realizability loss: The realizability loss smooths the object surface for 3D printing and prevents generating geometry underneath the road surface.Surface smoothness is promoted using a Laplacian loss.
  • Stealthiness designs: An L∞-constrained PGD update limits each vertex’s per-dimension movement, with smaller ϵ producing a stealthier adversarial object.Surface smoothness also helps the object look normal in practice.
  • Attack robustness: Random yaw rotations and ground-plane shifts improve robustness against different victim approaching distances and angles.The goal is continuous nondetection until the vehicle is closer than its braking distance.

V. ATTACK EVALUATION

MSF-ADV is evaluated across representative rule-based fusion combinations, object types, driving scenarios, and attack settings. It achieves high effectiveness while remaining stealthy, printable, transferable, and robust to victim positions.

  • A. Evaluation Methodology and Setup: Four MSF combinations from Apollo and Autoware.AI pair two LiDAR models with two camera models, covering three supported object types.The combinations use A5-L, A2-L, A5-C, and Y3; experiments include traffic cones, benches, and toy cars.
  • B. Attack Effectiveness: At least 91% success was achieved for every object type and MSF combination, with 100% success for traffic cones and benches.Each object was 100% detected in the benign case across 100 driving scenarios.
  • B. Attack Effectiveness: 3.4 cm average per-vertex movement enabled at least 91% success across all MSF combinations under a ϵ = 2 cm stealthiness setting.The evaluation also measured LPIPS and conducted a 105-participant traffic-cone user study.
  • B. Attack Effectiveness: 100% of generated objects passed printability checks, while printability improvements reduced printing difficulties from 58.9% to 74.3%.Transfer attacks among the four MSF combinations achieved around 75% success on average.

C. Comparison with Baseline Attack Methods

MSF-ADV substantially outperforms Gaussian-noise and genetic-algorithm baselines in attack success and optimization efficiency. Its differentiable approximation design supports effective gradient-based optimization.

  • Evaluation methodology: GN and GA are evaluated against MSF-ADV using the same traffic-cone setting on A5-L +⃝ A5-C.GN tests similar-level shape perturbations, while GA retains the objective function but removes differentiability.
  • Results: 100% of MSF-ADV attacks succeeded, compared with 8% for GN and 9% for GA.GN moved each vertex 3.35 cm on average, slightly more than MSF-ADV’s 3.28 cm, while GA ran for twice as many generated objects.
  • Results: MSF-ADV achieved the fitness-value decrease reached by GA after 2000 trials in only 133 trials, making it 15× more efficient.The comparison uses averaged fitness trends over 100 attack scenarios.
  • Robustness evaluation: EoT improved average success rates across victim position ranges by 20.5% on average, producing success rates above 95%.The evaluation varies longitudinal and lateral victim-object positions over ranges corresponding to braking distances from approximately 20 to 55 mph.

E. Physical-World Attack Realizability Evaluation

Physical-world experiments show that 3D-printed adversarial objects can evade LiDAR and jointly evade LiDAR and camera detection. The attack also transfers across MSF combinations in miniature-scale testing.

  • Experimental scope: The physical-world evaluation combines real-device sensing with miniature-scale testing because real-vehicle experiments were available only for the LiDAR side.The authors report losing access to the experiment vehicle after the early-stage LiDAR experiments.
  • Real Vehicle based Experiments: The real-vehicle experiment used a 1:1 3D-printed adversarial cube and a Velodyne HDL-64E LiDAR.This experiment targeted the A2-L Apollo LiDAR model using a manually driven vehicle on a real road.
  • Real Vehicle based Experiments: The adversarial cube was detected in only 0.9% (1) of 108 LiDAR frames, versus 84.8% (84) detection for the benign cube.The experiment collected traces in front of and to the left of the cube.
  • Miniature-Scale Experiments: At 20 randomly sampled miniature-scale positions, the adversarial traffic cone achieved a 90% attack success rate against A5-L +⃝ A5-C.The benign cone had a 95% detection rate, while the adversarial cone was detected at only 10% of the same positions.
  • Miniature-Scale Experiments: Transfer to A2-L +⃝ A5-C achieved 85% success across the 20 positions and 87.5% where the benign cone was detectable.The cone was 3D-printed at 1:6.67 scale with 380 um precision and evaluated using physical LiDAR and camera devices.

VI. END-TO-END ATTACK SIMULATION EVALUATION

An end-to-end Apollo-LGSVL simulation evaluates whether the adversarial traffic cone causes a vehicle-level safety failure. Across 100 runs, the adversarial case always collided while the benign case avoided collision.

  • Evaluation methodology: The end-to-end evaluation imports the adversarial traffic-cone mesh into LGSVL and uses Apollo to control a vehicle on a single-lane road.The simulator is an open-source Unity-based environment designed for industry-grade AD testing and development.
  • Results: 100% vehicle collision rate occurred across 100 adversarial runs, while the benign case had a 0% crash rate.The adversarial cone evaded both camera and LiDAR perception before fusion at every frame before collision.
  • Results: In the adversarial case, Apollo maintained its speed because it could not detect the cone even when it was directly ahead.In the benign case, Apollo detected the cone and stopped the vehicle at 0 km/h.
  • Evaluation scope: The study assesses end-to-end attack impact in a production-grade simulator rather than on a real autonomous vehicle.The authors cite cost and safety considerations as reasons for using simulation-based evaluation.
  • Limitations: Effectiveness against DNN-based MSF algorithms remains unevaluated, although the authors state that the attack design is applicable to both fusion designs.The current evaluation targets rule-based fusion in representative industry-grade systems.

1) DNN-Level Defense:

The paper evaluates input transformations and training-based defenses against MSF-ADV, finding that existing defenses reduce but do not eliminate attack success. It also discusses broader MSF-level defenses and summarizes the paper’s security findings.

  • DNN-Level Defenses: Four input transformations—bit-depth reduction, median smoothing, JPEG compression, and autoencoder reformation—are evaluated without model retraining.These defenses target camera and/or LiDAR inputs, depending on the method.
  • DNN-Level Defenses: 66% attack success rate is achieved after median smoothing, the strongest evaluated input-transformation defense, without affecting benign detection rate.The evaluation varies transformation parameters to examine the trade-off between benign detection and attack success.
  • DNN-Level Defenses: 69% attack success rate is achieved by augmenting training data with 100% benign detection rate, whereas adversarial training reduces attack success only to 95%.The adversarial-training result uses 900 epochs and a two-step PGD setup in the reported preliminary exploration.
  • DNN-Level Defenses: The strongest evaluated defense reduces attack success only to 66%, which the authors deem insufficient to make the attack practically unexploitable.The paper proposes exploring other input transformations, more effective adversarial training, and certified robustness extended to 3D physical attacks.
  • MSF-Level Defenses: At the MSF level, the paper suggests fusing more sensors with different viewing positions and considering RADAR to improve security.These suggestions are presented as possible future defense directions rather than evaluated defenses.
  • Overall Findings: The paper reports over 90% attack success across object types and MSF algorithms while describing the attack as stealthy, robust, transferable, and physically realizable.The conclusion also reports a 100% vehicle collision rate in simulation.

APPENDIX

The realizability loss encourages adversarial meshes that are smooth, printable, and positioned above the road surface. Its components regularize vertex displacement and constrain the lowest mesh height.

  • Realizability Loss: The realizability loss Lr(·) improves printability and prevents the adversarial object Sa from being generated underneath the road surface.Its first and second parts respectively target these two objectives.
  • Realizability Loss: The first loss component is a Laplacian loss that penalizes differences between each vertex’s displacement and those of neighboring vertices.This promotes surface smoothness and lowers the precision requirements of the 3D printer.
  • Realizability Loss: Quadric Edge Collapse Decimation is optionally applied after optimization to further improve mesh printability.The method changes vertex positions while retaining the benign object’s original vertex connections.
  • Realizability Loss: The second loss component minimizes the distance between the lowest vertex heights of Sa and the original object S.β1 controls this term, which penalizes moving adversarial vertices below the road surface.

B. Attack Stealthiness User Study

The user study finds that adversarial traffic cones are visually inconspicuous, while printability improvements create a trade-off between manufacturing ease and attack success. Sensitivity analysis identifies the differentiable point-inclusion approximation as critical.

  • Attack Stealthiness User Study: 105 participants with driving experience evaluated benign, adversarial, and broken traffic-cone shapes in rendered driving images.The study used two real-world driving images and included a “No Anomaly” response option.
  • Attack Stealthiness User Study: Adv and Benign were judged valid traffic cones by similar proportions of users, while Adv was selected least often as having the most anomalous shape.The authors conclude that the adversarial cone appeared at least as innocent as the original cone and less suspicious than certain broken cones.
  • Parameter Sensitivity: The attack is most sensitive to μ, which controls its differentiable approximation of the point-inclusion calculation.Learning rate, λ, and PGD initialization also affect results, but mainly outside a certain magnitude range.
  • Printability Evaluation: All generated objects are watertight and accepted as printable by PreForm, whether or not printability-improvement methods are used.This follows because the attack manipulates vertex positions without changing the original vertex connections.
  • Printability Evaluation: 74.3% lower self-intersection ratio and 58.9% lower curvature are obtained with Laplacian loss without reducing attack success rate.Laplacian loss alone is described as particularly cost-effective for improving printability.
  • Printability Evaluation: Combining Laplacian loss with QECD reduces self-intersection further but incurs an 8% success-rate decrease, creating a cost-effectiveness trade-off.The paper recommends Laplacian loss alone when attack success is prioritized and combination with QECD when printing cost matters more.

E. Details of the DNN-Level Defenses Evaluated in §VII-B1

The evaluated DNN defenses transform camera or LiDAR inputs, reconstruct camera images, or retrain detection models. Their settings vary input quality, autoencoder compression, or adversarial-training procedures.

  • Input Transformations: Bit-depth reduction lowers the precision of camera RGB channels and LiDAR point fields, with experiments spanning 5-bit to 1-bit inputs.Higher bit depth corresponds to higher input quality after reduction.
  • Input Transformations: Median smoothing applies neighborhood median filters to both LiDAR points and camera pixels using different kernel sizes.The method is evaluated as one of the four input-transformation defenses.
  • Input Transformations: Autoencoder reformation is applied only to images and is evaluated with four architectures: C, A-1, A-2, and A-3.Adding pooling layers decreases latent-space dimension, increasing compression and lowering input quality.
  • Training-Based Defenses: Adversarial training adapts a camera object-detection method by replacing its training-loop attack with MSF-ADV.Because Apollo does not release its training data, this defense is evaluated on Y3, or YOLO v3.
  • Training-Based Defenses: The adversarial-training implementation uses an acceleration method with randomly initialized adversarial inputs and fewer PGD steps per training iteration.The paper motivates this acceleration by the high cost of adversarial training for the physical-world attack.
Loading 2106.09249v1…