On the Adversarial Robustness of Camera-based 3D Object Detection

Abstract

In recent years, camera-based 3D object detection has gained widespread attention for its ability to achieve high performance with low computational cost. However, the robustness of these methods to adversarial attacks has not been thoroughly examined. In this study, we conduct the first comprehensive investigation of the robustness of leading camera-based 3D object detection methods under various adversarial conditions. Our experiments reveal five interesting findings: (a) the use of accurate depth estimation effectively improves robustness; (b) depth-estimationfree approaches do not show superior robustness; (c) bird'seye-view-based representations exhibit greater robustness against localization attacks; (d) incorporating multi-frame benign inputs can effectively mitigate adversarial attacks; and (e) addressing long-tail problems can enhance robustness. We hope our work can provide guidance for the design of future camera-based object detection modules with improved adversarial robustness.

Efficiently generating sentence-level textual adversarial examples with Seq2seq Stacked Auto-Encoder

“…Adv. Type Additional Requirements Cao et al [5,6] Poses 3D Mesh Model, Annotation Tu et al [47,48] Poses, Scenes 3D Mesh Model, Annotation Xie et al [61] Scenes, Categories 2D Patch Model, Annotation Adv3D Poses, Scenes, Categories 3D NeRF Model Table 1: Comparison with prior works of adversarial attack in autonomous driving.…”

“…During the evaluation, we render the input agnostic NeRF in randomly sampled poses, then we paste the rendered patch onto the unseen validation set to evaluate the attack performance. Owing to the transferability to poses and scenes, our adversarial examples can be executed without prior knowledge of the scene and do not need direct contact with the attacked objects, thus making for more feasible attacks compared with [47,48,61,66]. Finally, we provide thorough evaluations of Adv3D on camera-based 3D object detection with the nuScenes [4] dataset.…”

“…The BEV-based methods are BEVDet [20], BEVFormer-Tiny [30] and BEVFormer-Base. Following prior work [61], we evaluate the performance drop on the validation set after the attack. Specifically, we use the Mean Average Precision (mAP) and nuScenes Detection Score (NDS) [4] to evaluate the performance of 3D detectors.…”