Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving

Abstract

In Autonomous Vehicles (AVs), one fundamental pillar is perception, which leverages sensors like cameras and LiDARs (Light Detection and Ranging) to understand the driving environment. Due to its direct impact on road safety, multiple prior efforts have been made to study its the security of perception systems. In contrast to prior work that concentrates on camera-based perception, in this work we perform the first security study of LiDAR-based perception in AV settings, which is highly important but unexplored. We consider LiDAR spoofing attacks as the threat model and set the attack goal as spoofing obstacles close to the front of a victim AV. We find that blindly applying LiDAR spoofing is insufficient to achieve this goal due to the machine learning-based object detection process. Thus, we then explore the possibility of strategically controlling the spoofed attack to fool the machine learning model. We formulate this task as an optimization problem and design modeling methods for the input perturbation function and the objective function. We also identify the inherent limitations of directly solving the problem using optimization and design an algorithm that combines optimization and global sampling, which improves the attack success rates to around 75%. As a case study to understand the attack impact at the AV driving decision level, we construct and evaluate two attack scenarios that may damage road safety and mobility. We also discuss defense directions at the AV system, sensor, and machine learning model levels. CCS CONCEPTS• Security and privacy → Domain-specific security and privacy architectures; • Computer systems organization → Neural networks.

A Review and Perspective on Optical Phased Array for Automotive LiDAR

“…False negative is a failure in detecting a real target in time when the target does exist and must be sensed. False positives and false negatives can affect different sensor technologies for reasons like dynamic environment, spurious or multiple detection, hardware failures or software errors, and deliberate hacking [13]. • Sensor fusion.…”

Camdar‐adv: Generating adversarial patches on 3D object

“…The point cloud data will be fed to the DNN model after preprocessing. Finally, the system performs postprocessing on the output information of the DNN model to obtain the final prediction 18 …”

A first look at the integration of machine learning models in complex autonomous driving systems: a case study on Apollo

“…Deep-Billlboard [46] performs testing through attacking billboard images to mislead ADV DNN controls. Similar image-based testing, Cao et al [8] shows that LiDAR component could also be tested by performing well-designed attack techniques. Haq et al [14] recently performs a comprehensive study to compare the offline and online testing of DNN in the context of ADV, where they found that offline testing is often more optimistic than online testing and simulation-based methods can be useful in many cases.…”