Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving

Abstract

Modern self-driving perception systems have been shown to improve upon processing complementary inputs such as LiDAR with images. In isolation, 2D images have been found to be extremely vulnerable to adversarial attacks. Yet, there have been limited studies on the adversarial robustness of multi-modal models that fuse LiDAR features with image features. Furthermore, existing works do not consider physically realizable perturbations that are consistent across the input modalities. In this paper, we showcase practical susceptibilities of multi-sensor detection by placing an adversarial object on top of a host vehicle. We focus on physically realizable and input-agnostic attacks as they are feasible to execute in practice, and show that a single universal adversary can hide different host vehicles from state-of-the-art multi-modal detectors. Our experiments demonstrate that successful attacks are primarily caused by easily corrupted image features. Furthermore, we find that in modern sensor fusion methods which project image features into 3D, adversarial attacks can exploit the projection process to generate false positives across distant regions in 3D. Towards more robust multi-modal perception systems, we show that adversarial training with feature denoising can boost robustness to such attacks significantly. However, we find that standard adversarial defenses still struggle to prevent false positives which are also caused by inaccurate associations between 3D LiDAR points and 2D pixels.

Security Analysis of Camera-LiDAR Fusion Against Black-Box Attacks on Autonomous Vehicles

“…Thus, [40] also pivots to extracting valid occluded objects from KITTI, translating points to an attacker-desired location, and injecting them. Furthermore, [5,41,43] introduce attacks with adversarial patches and mesh objects that are optimized for color, shape, and texture, and digitally rendered into LiDAR and/or camera. Each attack performs optimization either over training data [5,41] or with white-box model access [43].…”

“…Furthermore, [5,41,43] introduce attacks with adversarial patches and mesh objects that are optimized for color, shape, and texture, and digitally rendered into LiDAR and/or camera. Each attack performs optimization either over training data [5,41] or with white-box model access [43]. However, the adversarial meshes may be too large to be physically realized outside of a fully-cyber context, and attacks are only evaluated on a single frame of data.…”

“…However, the adversarial meshes may be too large to be physically realized outside of a fully-cyber context, and attacks are only evaluated on a single frame of data. Finally, [41] illustrates that universal AV patch attacks are fragile, as their attack does not transfer between AV datasets.…”

“…We consider false positive (FP) and false negative (FN) attack outcomes consistent with the literature [8,40,41], as well as translation attack outcomes where a detected object's bounding box is translated (i.e., moved) by some distance. False positive outcome.…”

“…In particular, the increasing reliance of AVs on deep neural networks (DNNs) for real-time perception has sparked security questions at the algorithm level. There is a growing body of AV security work; for perception algorithms, an attacker can perturb sensor data to change object classification (i.e., resulting in misclassification) [13], introduce fake objects (i.e., false positive) [8,40], and remove existing objects (i.e., false negative) [5,41], each with devastating consequences at the driving decision and control level.…”