Towards Effective and Transferable Physical Camouflage against Multi-View BEV-based 3D Perception in Autonomous Driving

1 Introduction

• Vision-based autonomous driving relies on multiple cameras and deep neural networks, whose adversarial vulnerability raises safety concerns.Source: §1 · p. 1
• Single-view 2D attack pipelines cannot be directly applied to multi-view 3D perception, and prior patch attacks have limited viewpoint robustness and transferability.Source: §1 · p. 1
• BEVCA combines a mask-enhanced BEV adversarial loss with multi-view neural rendering to generate effective, transferable camouflage across models and tasks.Source: §1 · p. 2
• The mask targets BEV regions sensitive to car texture, while multi-view rendering produces realistic, consistent vehicle images across camera viewpoints for gradient-based optimization.Source: §1 · p. 2
• 36.2% average improvement in 3D object detection and 21.6% in segmentation; physical black-box tests achieved a 51.18% average attack success rate.Source: §1 · p. 2

2.1 Related work

• BEV models aggregate multi-view driving images into a unified representation supporting tasks including 3D detection, map segmentation, and end-to-end driving.Source: §2.1 · p. 3
• Earlier 2D attacks optimize textures through rendered transformed images, while multi-view 3D attacks use patches or NeRF-generated textures.Source: §2.1 · p. 3
• BEVCA combines multi-view neural rendering and BEV-feature-based adversarial attacks to target multi-view BEV-based 3D perception.Source: §2.1 · p. 3

2.2 Threat Model

• The target is a multi-view perception model that constructs BEV features for downstream tasks such as object detection and segmentation.Source: §2.2 · p. 3
• The attacker optimizes textures offline using simulation and white-box access, then passively deploys them; black-box deployment assumes BEV representations but no access to model weights or intermediate features.Source: §2.2 · p. 3

3.1 Overview

• Multi-view rendering produces camouflaged vehicle images, while a no-vehicle comparison and BEV mask identify affected regions for the adversarial loss; TV loss encourages texture naturalness.Source: §3.1 · pp. 4–5, Figure 2 · p. 4

3.2 Multi-view Neural Rendering

• The multi-view renderer computes each ego-mounted camera’s pose relative to the target vehicle, enabling perspective-accurate rendering across all six cameras.Source: §3.2 · p. 5

3.3 BEV-Feature-based Adversarial Attack

• The BEV-feature attack compares camouflaged and vehicle-removed features, uses their difference and an annotated-position mask to localize vehicle-associated regions, then averages nonzero masked elements for the adversarial loss.High-activation regions tend to coincide with the target vehicle’s ground-truth location; TV loss encourages texture naturalness.Source: §3.3 · p. 6

4.1 Experimental Settings

• Experiments use Carla data for an Audi E-Tron, fine-tune target models for one epoch, and evaluate digital AP or IoU and physical ASR.Generation and test datasets contain 2,500 and 500 samples, respectively; physical evaluation uses 150 samples per condition.Source: §4.1 · pp. 6–7

4.2 Attack Performance Evaluation

• BEVCA achieves an approximately 36.2% average performance gain over the best previous baseline in black-box digital settings for 3D object detection.The comparison spans multi-view perception models and includes the Table 1 attack results.Source: §4.2 · p. 7, Table 1 · p. 8
• BEVCA achieves an approximately 21.6% average improvement over the strongest previous baseline in black-box BEV segmentation settings.It has the best attack performance across all tested segmentation models despite being optimized for BEVFormer-base.Source: §4.2 · p. 7, Table 1 · p. 8
• BEVCA attains an average 51.18% ASR in black-box physical-world evaluation and exceeds CNCA across all four victim models.The camouflage was printed as a UV map and applied to a full-size Audi; examples show the vehicle undetected from different camera viewpoints.Source: §4.2 · pp. 7–8, Table 2 · p. 8, Figure 4 · p. 8

4.3 Ablation Studies

• Masked BEV-feature optimization performs best across black-box detection and segmentation models; unmasked BEV attacks have almost no effect amid noise from irrelevant regions.The target vehicle occupies approximately 3% of the BEV area; additional appendix analyses examine hyperparameter sensitivity and simple defense transformations.Source: Table 3 · p. 9, §4.3 · p. 9

• BEVCA is an adversarial camouflage framework for multi-view BEV-based 3D perception.Source: §5 · p. 9
• Its BEV-feature-based adversarial loss supports transferable attacks, while multi-view neural rendering facilitates gradient-based camouflage optimization.Source: §5 · p. 9
• Experiments on 3D detection and BEV segmentation report consistent improvements over baselines on diverse black-box models and practical effectiveness in physical experiments.Source: §5 · p. 9

• The sim-to-real gap includes UV-map deformation and lighting conditions, which the authors leave for future systematic quantification.Source: §6 · p. 9
• Adversarial textures are tied to a vehicle’s 3D geometry; transfer to another vehicle class requires one-time offline re-optimization.Source: §6 · p. 9
• Robustness of Vision-Language-Action models against adversarial camouflage remains a future research direction.Source: §6 · p. 9

7 Impact Statement

• The authors note potential malicious misuse but position the attack as a tool for adversarial training, testing, and detection.They state that exposing vulnerabilities under realistic physical conditions contributes to AD security and reliability.Source: §7 · p. 10

A Multi-View Camera Pose Transformation Details

• CARLA’s left-handed coordinates are converted to PyTorch3D’s right-handed convention before constructing the camera-pose transformations.The conversion transforms positions and rotations using M = diag(1, −1, 1).Source: A Multi-View Camera Pose… · p. 12
• The renderer transforms pose information from ego-mounted cameras into the target vehicle coordinate system and applies the procedure to all six cameras.The inputs include ego and target vehicle positions and rotations, plus camera pose in the ego-vehicle frame.Source: A Multi-View Camera Pose… · p. 12

B Physical World Experiments

• The real-world setup applies BEVCA camouflage to a full-size Audi and collects three paint-condition datasets with six cameras and 150 samples per dataset.Samples vary in azimuth and distance relative to the ego position.Source: B Physical World Experiments · p. 12
• Table 4 compares normal painting, BEVCA attack, and adversarial training using vehicle-class AP for 3D detection and IoU for BEV segmentation.Source: Table 4 · p. 13

C Multi-view Attack Visualization

• Camouflaged vehicles produce inaccurate bounding boxes or disappear from detection, with successful attacks when the vehicle appears across views.The passage also describes physical-world examples using full camera views.Source: C Multi-view Attack Visualization · p. 13

D Enhancing Model Robustness via Adversarial Training

• Fine-tuning uses 500 camouflage-generated samples collected under camera configurations different from those used for evaluation.Source: D Enhancing Model Robustness via… · p. 13
• BEVFormer-base detection score drops from 0.618 to 0.191, while CVT falls from 0.609 to 0.307 under attack.Source: D Enhancing Model Robustness via… · p. 13
• Adversarial training raises BEVFormer-base detection score to 0.615 and CVT to 0.567.Source: D Enhancing Model Robustness via… · p. 13

E Multi-view robust attack.

• Experiments sample distances of 10, 15, 25, and 40 meters and six azimuths, with 40 varied-background samples per combination.Source: E Multi-view robust attack · pp. 13, 16
• AP rises at shorter distances and declines beyond 25 meters, yet attacks remain strong across tested configurations.The authors attribute the decline to harder-to-identify fine-grained patterns and reduced model detection performance at long ranges.Source: Table 5 · p. 16, E Multi-view robust attack · p. 16

F Effectiveness of hyperparameters during optimization.

• Total-variation loss consistently improves attack performance as β rises; the best BEV-mask thresholds are ∆r=15 and ∆θ=15.Small β yields incoherent textures and weaker signals, especially at long ranges; the selected mask settings are fixed throughout the experiments.Source: Figure 8 · p. 16, F Effectiveness of hyperparameters… · p. 16

G Robustness Against Simple Defenses.

• Aggressive smoothing or JPEG compression can marginally weaken attacks but also impose clean-data performance trade-offs; BEVCA retains a large gap over baseline across tested settings.Source: G Robustness Against Simple Defenses · p. 17, Table 6 · p. 17

H Attack Performance on Original Targeted Models

• BEVCA outperforms all baselines on original target models despite performance gaps between simulation and reality.Table 7 compares 3D detection AP and vehicle-class BEV segmentation IoU.Source: H Attack Performance on Original… · p. 17, Table 7 · p. 18

I Usage of LLMs

• The authors report using LLMs for editing and experiment-analysis code, while stating the core ideas and methodology are original.Source: I Usage of LLMs · p. 17

Limitations

• The authors report discussing limitations in a dedicated section.The checklist does not specify what those limitations are.Source: NeurIPS Paper Checklist · p. 18

Reproducibility and open access

• The authors report open-sourcing code and describing experimental details for reproducibility.They also state that code and data links are provided in the abstract.Source: NeurIPS Paper Checklist · pp. 19–20

Experimental details and resources

• The checklist says the experimental setting is detailed in Section 4.1 and that compute resources are described there.Source: NeurIPS Paper Checklist · pp. 20–21

Statistical significance

• The authors report mAP, IoU, and ASR on datasets of at least 150 samples as support for statistical significance.Source: NeurIPS Paper Checklist · p. 21

Ethics, impacts, and assets

• The checklist reports compliance with the NeurIPS Code of Ethics, discussion of societal impacts, and proper crediting of used assets and documentation of new assets.It identifies the multi-view neural rendering module and BEV-feature-based adversarial loss as new assets.Source: NeurIPS Paper Checklist · pp. 21–23

Research scope

• The authors state that the paper involves neither crowdsourcing nor research with human subjects, and that LLM usage is discussed in Section I.The checklist also marks theoretical assumptions and proofs as not applicable because the work is mostly experimental.Source: NeurIPS Paper Checklist · pp. 19, 23, 24