Physically Realizable Adversarial Examples for LiDAR Object Detection

Tu, James; Ren, Mengye; Manivasagam, Sivabalan; Liang, Ming; Yang, Bin; Du, Ruxu; Cheng, Feiyan; Urtasun, Raquel

doi:10.1109/cvpr42600.2020.01373

Cited by 153 publications

(115 citation statements)

References 2 publications

Supporting

Mentioning

111

Contrasting

Unclassified

Order By: Relevance

“…Referring to the contour of 3D adversarial examples in References [12,13] we manually created a 3D object

O_{adv}

with irregular contours using a modeling tool. The shape of

O_{adv}

is similar to a cube with a side length of 50 cm, as shown in Figure 2.…”

Section: The Projection From 3d To 2dmentioning

confidence: 99%

“…18 Some researchers successfully attacked the LiDAR-based system by 3D adversarial examples. 12,13 The time difference between the laser and its reflection, which indirectly caused the point cloud data to change, was influenced by the objects. And eventually inducing the system to make wrong decisions during the postprocessing stage.…”

Section: Attacks Against the Lidar-based Systemmentioning

confidence: 99%

“…6 Some works successfully attacked image recognition 7,8 and target detection [9][10][11] models with adversarial examples printed by printer. Cao 12 and Tu 13 used optimization-based methods to generate 3D adversarial examples, and construct them in the physical world to attack the LiDAR-based detecting system of the autonomous driving platform.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Camdar‐adv: Generating adversarial patches on 3D object

Chen

Huang

2020

Int J Intell Syst

View full text Add to dashboard Cite

Deep neural network model is the core technology for sensors of the autonomous driving platform to perceive the external environment. Recent research have shown that it has a certain vulnerability. The artificial designed adversarial examples can make the DNN model output the wrong results. These adversarial examples not only exist in the digital world, but also in the physical world. At present, research on autonomous driving platform mainly focus on attacking a single sensor. In this paper, we introduce Camdar-adv, a method for generating image adversarial examples on three-dimensional (3D) objects, which could potentially lunch a multisensor attack toward the autonomous driving platforms. Specifically, with objects that can attack LiDAR sensors, a geometric transformation can be used to project their shape onto the twodimensional plane. Adversarial perturbations against optical image sensor could be added to the surface of the adversarial 3D objects precisely without changing its geometry. Test results on the open-source autonomous driving data set KITTI show that Camdar-adv can generate adversarial samples for the state of the art object detection model. From a fixed viewpoint, our method can achieve an attack success rate over 99%.

show abstract

“…Referring to the contour of 3D adversarial examples in References [12,13] we manually created a 3D object

O_{adv}

with irregular contours using a modeling tool. The shape of

O_{adv}

is similar to a cube with a side length of 50 cm, as shown in Figure 2.…”

Section: The Projection From 3d To 2dmentioning

confidence: 99%

Section: Attacks Against the Lidar-based Systemmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Camdar‐adv: Generating adversarial patches on 3D object

Chen

Huang

2020

Int J Intell Syst

View full text Add to dashboard Cite

show abstract

“…The 3D-printed physical object can extend invisibility to its immediate neighboring objects. 11 By placing a 3D-printed adversarial example object on top of a vehicle, the vehicle becomes (partially) invisible to the targeted lidar detector system. › Real-world model stealing attacks:…”

Section: Toward Real-world Aml Attacksmentioning

confidence: 99%

Adversarial Machine Learning: Attacks From Laboratories to the Real World

Lin¹,

Biggio

2021

Computer

View full text Add to dashboard Cite

“…Regarding data augmentation, there have been multiple approaches going from transformations of a real training set [ 11 , 12 , 13 , 14 , 15 , 16 ], to combinations of real and synthetic data [ 17 , 18 , 19 , 20 ], to purely synthetic data [ 21 , 22 , 23 ] and domain adaptation techniques [ 24 , 25 , 26 ]. In [ 12 ], the point clouds of previously labeled objects are added by concatenation at different positions into the training data in order to improve the training of the network.…”

Section: Introductionmentioning

confidence: 99%

Data Augmentation of Automotive LIDAR Point Clouds under Adverse Weather Situations

Rivero

Gerbich

Buschardt

et al. 2021

Sensors

View full text Add to dashboard Cite

In contrast to previous works on data augmentation using LIDAR (Light Detection and Ranging), which mostly consider point clouds under good weather conditions, this paper uses point clouds which are affected by spray. Spray water can be a cause of phantom braking and understanding how to handle the extra detections caused by it is an important step in the development of ADAS (Advanced Driver Assistance Systems)/AV (Autonomous Vehicles) functions. The extra detections caused by spray cannot be safely removed without considering cases in which real solid objects may be present in the same region in which the detections caused by spray take place. As collecting real examples would be extremely difficult, the use of synthetic data is proposed. Real scenes are reconstructed virtually with an added extra object in the spray region, in a way that the detections caused by this obstacle match the characteristics a real object in the same position would have regarding intensity, echo number and occlusion. The detections generated by the obstacle are then used to augment the real data, obtaining, after occlusion effects are added, a good approximation of the desired training data. This data is used to train a classifier achieving an average F-Score of 92. The performance of the classifier is analyzed in detail based on the characteristics of the synthetic object: size, position, reflection, duration. The proposed method can be easily expanded to different kinds of obstacles and classifier types.

show abstract

Physically Realizable Adversarial Examples for LiDAR Object Detection

Cited by 153 publications

References 2 publications

Camdar‐adv: Generating adversarial patches on 3D object

Camdar‐adv: Generating adversarial patches on 3D object

Adversarial Machine Learning: Attacks From Laboratories to the Real World

Data Augmentation of Automotive LIDAR Point Clouds under Adverse Weather Situations

Contact Info

Product

Resources

About