PaperlayerView exact revision on arXiv

Source-linked AI summary

LiDAR-SHIELD: A Fully Dockerized Adversarial Robustness Assessment Framework for LiDAR-Based 3D Perception Models

Alexandros Gkillas, Ioulia Kapsali, Christos Anagnostopoulos, Aris S. Lalos

arXiv:2610.39848v1cs.CVcs.AI

TL;DR

LiDAR adversarial-robustness evaluation is fragmented across task-specific implementations and model-dependent software stacks. LIDAR-SHIELD provides a Dockerized service-oriented framework with a task-aware attack suite for segmentation and detection. Its experiments report vulnerabilities across heterogeneous LiDAR backbones.

  • Problem

    Existing LiDAR adversarial-evaluation tools are tied to particular tasks, architectures, and software stacks, leaving no unified Dockerized tool for both segmentation and detection.

    Source: §I · p. 1, §II · p. 2

  • Method

    LIDAR-SHIELD keeps target models in their native environments and uses a shared service interface, adapters, and task-aware attacks for segmentation and detection.

    Source: §I · pp. 1–2, B. Components · p. 3

  • Results

    Experiments on SemanticKITTI, SemanticPOSS, KITTI, and CARLA confirm that the integrated attacks expose significant vulnerabilities across heterogeneous LiDAR backbones.

    Source: §VI · p. 5

  • Takeaways & Limitations

    The framework supports adversarial stress-testing across both LiDAR perception tasks and heterogeneous backbones within one workflow.

    Source: §VI · p. 5

Abstract

from arXiv · show

LiDAR-based 3D perception underpins autonomous driving and robotics, yet deploying these models safely requires stress-testing them against adversarial inputs before real-world use. Although state-of-the-art adversarial attacks exist, their implementations are often fragmented across individual repositories, each tied to a specific architecture or task and requiring manual environment reconstruction and model-specific integration code. We present LIDARSHIELD, a unified and fully Dockerized framework that reverses this workflow: rather than installing the target model inside the toolkit, LIDARSHIELD exposes any model through three lightweight HTTP endpoints, namely /info, /forward, and /gradient As a result, connecting a new model or dataset requires only a single loader function or adapter. The framework supports both 3D semantic segmentation and 3D object detection through the same engine-service protocol, integrating a task-aware suite of state-of-the-art attacks, including PGD and Square Attack for segmentation, and point perturbation, point removal, point injection, and LiDAttack for detection. This enables systematic exposure of corner cases and vulnerabilities across heterogeneous LiDAR backbones. The LiDAR-Shield codebase is publicly available at https://github.com/alexandrosgk/LiDAR-shield.

I. INTRODUCTION

LiDAR adversarial-robustness tools are fragmented across tasks and model-specific software stacks, complicating systematic evaluation. LIDAR-SHIELD uses a service-oriented, Dockerized workflow to unify model access and task-aware attacks across 3D segmentation and detection.

I. INTRODUCTION

  • Adversarial stress-testing is intended to expose LiDAR corner cases and vulnerabilities that clean benchmarks do not expose.The motivation applies to LiDAR perception before deployment.Source: §I · p. 1
  • Existing toolkits and LiDAR attack implementations require model-specific integration, and none provides unified, reproducible adversarial evaluation across both LiDAR perception tasks.General toolkits lack native support for LiDAR point clouds and 3D outputs; existing LiDAR systems are task-limited or tied to specific architectures and software stacks.Source: §I · p. 1
  • LIDAR-SHIELD keeps target models in their native environments and connects them to the assessment engine through lightweight HTTP endpoints.A model or dataset can be connected through a loader function or adapter, without bringing model code into the framework or creating dependency conflicts.Source: §I · p. 1
  • The framework provides one workflow for robustness evaluation across 3D semantic segmentation and 3D object detection.Its task-aware attack suite includes PGD and Square Attack for segmentation, and point perturbation, removal, injection, and LiDAttack for detection.Source: §I · p. 2
  • The Dockerized deployment isolates data handling, model execution, and attack orchestration as a plug-and-play systems component.The stated aim is to reduce the engineering overhead of adversarial robustness testing.Source: §I · p. 2

II. RELATED WORK

Prior work establishes attacks against LiDAR perception, but reusable evaluation infrastructure remains fragmented across tasks, model families, and software stacks.

II. RELATED WORK

  • LiDAR attack implementations span multiple threat models and input representations, but do not provide reusable infrastructure covering both detection and segmentation.Prior work includes white-box and black-box attacks, physical attacks, and perturbations in range-image, point-cloud, or sensor space.Source: §II · p. 2
  • The diversity of LiDAR segmentation and detection backbones motivates an abstraction that accommodates different architectures without modifying the assessment core.The cited model families include dense segmentation networks and pillar-, voxel-, and center-based detection pipelines.Source: §II · p. 2
  • Existing toolkits embed target models in their own codebases, while point-cloud robustness benchmarks and LiDAR studies cover narrower tasks or threat settings.Prior examples include point-cloud classification, detection-only robustness evaluation, and unified evaluation focused on natural corruptions.Source: §II · p. 2

III. METHOD

LIDAR-SHIELD isolates dataset and model variability at system boundaries, allowing a task-aware assessment engine to operate across datasets and backbones. Its components divide dataset ingestion, attack orchestration, and model execution.

III. METHOD

  • LIDAR-SHIELD separates dataset variability and model variability into boundary contracts, leaving the assessment engine to run a task-aware, model-agnostic attack pipeline.The data contract maps dataset samples into engine payloads, while the model contract provides a common service interface for backbones.Source: §III · p. 2

A. Architectural Overview

  • The left-to-right pipeline normalizes dataset-native samples into requests and backbone-specific execution into a fixed service API.The framework standardizes how data enters the engine and how it queries models, not how datasets are stored or models implemented.Source: A. Architectural Overview · p. 2

B. Components

  • The architecture reaches the target model through /info, /forward, and /gradient while keeping it in its native environment.White-box attacks use /gradient; black-box attacks use /forward only.Source: Figure 1 · p. 3
  • The data adapter handles dataset-specific loading and packaging, the engine manages attack protocols, and the model service encapsulates model execution.Connecting a new dataset requires an adapter; connecting a new backbone requires a lightweight loader entry point returning the model, criterion, metadata, and device.Source: B. Components · p. 3

C. Interface Contract

Two narrow contracts define the engine’s data payload and model-service operations. The same workflow handles black-box and white-box attacks, varying model access rather than orchestration.

C. Interface Contract

  • The data contract supplies task-tagged inputs with supervision and metadata, while the model contract exposes /info, /forward, and /gradient.The endpoints return model and task metadata, task-native predictions, and input gradients needed by white-box attacks, respectively.Source: C. Interface Contract · p. 3

D. Engine Workflow

  • For each sample, the engine obtains a clean prediction, runs the selected attack, then collects outputs for the adversarial input.Black-box mode uses /forward outputs; white-box mode additionally invokes /gradient, without changing the surrounding orchestration.Source: D. Engine Workflow · p. 3

E. Supported Perception Tasks

LIDAR-SHIELD uses a shared engine-service protocol for segmentation and detection while selecting task-aware attacks. For segmentation, attacks perturb the projected range-view input under a loss-maximizing constraint, with both gradient-based and gradient-free options.

E. Supported Perception Tasks

  • The same service protocol supports both segmentation and detection, while the attack layer is task-aware.Segmentation returns dense predictions and detection returns structured object hypotheses.Source: E. Supported Perception Tasks · p. 3

A. Segmentation Attack Suite

  • Segmentation attacks perturb the projected range-view input to maximize segmentation loss subject to a perturbation budget.The input is Y and the ground-truth label map is Z; ϵ controls the perturbation budget.Source: A. Segmentation Attack Suite · p. 4
  • PGD uses the /gradient endpoint for iterative white-box updates, projecting each step onto an ℓp ball of radius ϵ.The update uses step size α and norm-specific gradient normalization for p ∈ {2, ∞}.Source: A. Segmentation Attack Suite · p. 4
  • Square Attack provides a black-box segmentation baseline using /forward-only query-efficient random search over square-shaped input regions under an ℓ∞ constraint.It requires no gradient access.Source: A. Segmentation Attack Suite · p. 4

B. Detection Attack Suite

The detection suite increases detection loss through point-cloud modifications designed to preserve geometric plausibility. It includes gradient-based perturbation, removal, and injection operators, plus a forward-only black-box attack.

B. Detection Attack Suite

  • Detection attacks construct an adversarial point cloud that increases detection loss while preserving the original scene’s geometric plausibility.The ground-truth object annotations are denoted by G.Source: B. Detection Attack Suite · p. 4
  • Point perturbation displaces existing points by small coordinate offsets bounded by ϵ and optimized iteratively with PGD using gradients from /gradient.The per-point displacement constraint is applied to each point.Source: B. Detection Attack Suite · p. 4
  • Point removal deletes informative returns in decreasing saliency order, scoring each point by the ℓ2 norm of its detection-loss gradient.Already-removed points are excluded from subsequent gradient computations.Source: B. Detection Attack Suite · p. 4
  • Point injection adds points initialized at high-saliency locations and optimizes only the injected set under a Chamfer distance constraint.The operators follow established point-manipulation literature,,.Source: B. Detection Attack Suite · p. 4
  • LiDAttack is the black-box detection baseline, using a genetic algorithm with simulated annealing to find point-cloud modifications through /forward only.It operates without gradient access.Source: B. Detection Attack Suite · p. 4

C. Attack Comparison

The attack portfolio pairs white-box and black-box operators for each task, matching the perturbation space to the task input while retaining a shared engine-service interface.

C. Attack Comparison

  • Each task has white-box and black-box coverage, with range-view tensor attacks for segmentation and raw point-cloud attacks for detection.White-box attacks establish an upper bound on adversarial risk under full model access; black-box attacks probe robustness when gradients are unavailable.Source: C. Attack Comparison · p. 4

A. Experimental Setup

The experimental setup evaluates detection on KITTI and a CARLA-based simulated dataset, and segmentation on SemanticKITTI and SemanticPOSS. It uses two detection architectures and three pretrained range-view segmentation models.

1) 3D Object Detection:

  • Detection evaluation uses KITTI moderate-difficulty results and a CARLA Town06 dataset of 3,000 frames, with SECOND and PointPillars as detectors.KITTI contains real 64-channel LiDAR point clouds; CARLA data were collected at 10 Hz with a 64-channel LiDAR sensor.Source: 1) 3D Object Detection · p. 4

2) 3D Semantic Segmentation:

  • Segmentation evaluation uses SemanticKITTI and SemanticPOSS, with LENet, CENet, and FIDNet as pretrained range-view models.The datasets use different sensors and range-view sizes: SemanticKITTI is 64×1024 and SemanticPOSS is 40×1800.Source: 2) 3D Semantic Segmentation · p. 5

B. Attack Configurations

The attack configurations specify task-specific white-box and black-box settings for detection and segmentation, with metrics for quantifying attack effectiveness and perceptibility.

1) 3D Object Detection:

  • Detection uses ℓ2-bounded PGD for point perturbation, saliency-driven point removal, and constrained point injection; LiDAttack provides a forward-only point-injection attack.The LiDAttack configuration optimizes 20 points within 0.5 m of a target box, with up to 1000 forward queries.Source: 1) 3D Object Detection · p. 5

2) 3D Semantic Segmentation:

  • On SemanticKITTI, LENet evaluation uses white-box PGD under ℓ2 constraints (ϵ ∈ {3, 6, 9}) and ℓ∞ constraints (ϵ ∈ {0.1, 0.3, 0.5}), with T = 40 and α = ϵ/T.Square Attack uses an ℓ∞ constraint with ϵ = 0.3, 1000 queries, one random restart, and an initial perturbation probability pinit = 0.4.Source: 2) 3D Semantic Segmentation · p. 5

C. Evaluation Metrics

  • Detection effectiveness is measured by mAP and mAP ratio, geometric perceptibility by symmetric Chamfer Distance, and segmentation performance by mean IoU.Lower mAP and mAP ratio indicate stronger degradation; lower Chamfer Distance indicates better geometric plausibility.Source: C. Evaluation Metrics · p. 5

1) 3D Object Detection Results:

Experiments report vulnerabilities across segmentation and detection backbones, with degradation patterns varying by task, attack, and model.

1) 3D Object Detection Results:

  • Point perturbation degrades both detectors on KITTI and CARLA, with PointPillars mAP ratio falling to 10.59% on KITTI and 3.46% on CARLA at ϵ = 10 cm.SECOND retains higher relative performance; point removal causes more gradual degradation. The detection table reports mAP ratio and Chamfer Distance.Source: 1) 3D Object Detection Results · p. 5
  • On KITTI, LiDAttack reduces SECOND mAP from 70.43 to 52.51, while point removal and point injection produce different degradation and geometric-distance patterns.At the highest removal ratio, SECOND retains 67.98% on KITTI and 85.32% on CARLA; increasing the injection attachment radius does not always strengthen the attack.Source: 1) 3D Object Detection Results · p. 5

2) 3D Semantic Segmentation Results:

  • On SemanticKITTI, LENet mIoU falls from 64.7 to 41.7 under the strongest ℓ2 attack and to 34.7 under the strongest ℓ∞ attack.On SemanticPOSS, it falls from 52.7 to 34.4 under ℓ2 and to 28.8 under ℓ∞; Square Attack reduces SemanticKITTI mIoU from 64.7 to 19.5. LENet, CENet, and FIDNet all degrade under attack.Source: 2) 3D Semantic Segmentation Results · p. 5

VI. CONCLUSION

  • Across SemanticKITTI, SemanticPOSS, KITTI, and CARLA, integrated attacks expose significant vulnerabilities across heterogeneous LiDAR backbones.The conclusion covers both 3D semantic segmentation and 3D object detection.Source: §VI · p. 5

Related papers

Loading 2610.39848v1…