Shadow-Catcher: Looking into Shadows to Detect Ghost Objects in Autonomous Vehicle 3D Sensing

Hau, Zhongyuan; Demetriou, Soteris; Muñoz-González, Luis; Lupu, Emil

doi:10.1007/978-3-030-88418-5_33

Cited by 11 publications

(13 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…3D Shadows as physical invariant. 3D shadows have been introduced by Hau et al in [6] as a phyiscal invariant to verify genuine objects in a 3D point cloud scene and detect object spoofing attacks. In object spoofing attacks [5], [7]- [9], point cloud measurements are injected into a scene to spoof objects that are then erroneously detected by 3D-object detectors used by AVs.…”

Section: Using 3d Shadows To Detect Hidden Objectsmentioning

confidence: 99%

See 1 more Smart Citation

Using 3D Shadows to Detect Object Hiding Attacks on Autonomous Vehicle Perception

Hau¹,

Demetriou²,

Lupu³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

Autonomous Vehicles (AVs) are mostly reliant on LiDAR sensors which enable spatial perception of their surroundings and help make driving decisions. Recent works demonstrated attacks that aim to hide objects from AV perception, which can result in severe consequences. 3D shadows, are regions void of measurements in 3D point clouds which arise from occlusions of objects in a scene. 3D shadows were proposed as a physical invariant valuable for detecting spoofed or fake objects. In this work, we leverage 3D shadows to locate obstacles that are hidden from object detectors. We achieve this by searching for void regions and locating the obstacles that cause these shadows. Our proposed methodology can be used to detect an object that has been hidden by an adversary as these objects, while hidden from 3D object detectors, still induce shadow artifacts in 3D point clouds, which we use for obstacle detection. We show that using 3D shadows for obstacle detection can achieve high accuracy in matching shadows to their object and provide precise prediction of an obstacle's distance from the ego-vehicle.

show abstract

Section: Using 3d Shadows To Detect Hidden Objectsmentioning

confidence: 99%

“…Our work. 3D shadows in LiDAR point clouds, introduced in [6], are a physical phenomenon that is caused by occlusion of LiDAR laser pulses by objects in a scene. The authors leverage these shadow artifacts as a physical invariant to detect LiDAR spoofing attacks.…”

Section: Introductionmentioning

confidence: 99%

Using 3D Shadows to Detect Object Hiding Attacks on Autonomous Vehicle Perception

Hau¹,

Demetriou²,

Lupu³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…For defenses against point cloud attacks on 3D object detection, [40] introduced 1) CARLO -an empirical defense for binary classification between valid and invalid instances, and 2) SVF -a re-architecting of the perception model with multi-view projection, similar to [10], while [16] casts detecting spoof objects as a binary classification problem using the shadow region behind detections for features. Translation attack.…”

Section: Attacks On Perceptionmentioning

confidence: 99%

“…GhostBuster. Finally, the GhostBuster defense extracts features of the shadow region behind object detections, to perform binary classification into valid and invalid instances [16].…”

Section: Other Defense Algorithmsmentioning

confidence: 99%

Security Analysis of Camera-LiDAR Fusion Against Black-Box Attacks on Autonomous Vehicles

Hallyburton¹,

Liu²,

Cao³

et al. 2021

Preprint

View full text Add to dashboard Cite

To enable safe and reliable decision-making, autonomous vehicles (AVs) feed sensor data to perception algorithms to understand the environment. Sensor fusion, and particularly semantic fusion, with multi-frame tracking is becoming increasingly popular for detecting 3D objects. Recently, it was shown that LiDAR-based perception built on deep neural networks is vulnerable to LiDAR spoofing attacks. Thus, in this work, we perform the first analysis of camera-LiDAR fusion under spoofing attacks and the first security analysis of semantic fusion in any AV context. We find first that fusion is more successful than existing defenses at guarding against naive spoofing. However, we then define the frustum attack as a new class of attacks on AVs and find that semantic camera-LiDAR fusion exhibits widespread vulnerability to frustum attacks with between 70% and 90% success against target models. Importantly, the attacker needs less than 20 random spoof points on average for successful attacks -an order of magnitude less than established maximum capability. Finally, we are the first to analyze the longitudinal impact of perception attacks by showing the impact of multi-frame attacks.

show abstract

“…UAP present a systemic risk, as they enable practical and physically realizable adversarial attacks. They have been demonstrated in many widely-used and safety-critical applications such as camera-based computer vision [7,8,2,18] and LiDAR-based object detection [10,11]. UAPs have also been shown to facilitate realistic attacks in both the physical [23] and digital [24] domains.…”

Section: Introductionmentioning

confidence: 99%

Jacobian Ensembles Improve Robustness Trade-offs to Adversarial Attacks

Co¹,

Martínez-Rego²,

Hau³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Deep neural networks have become an integral part of our software infrastructure and are being deployed in many widely-used and safety-critical applications. However, their integration into many systems also brings with it the vulnerability to test time attacks in the form of Universal Adversarial Perturbations (UAPs). UAPs are a class of perturbations that when applied to any input causes model misclassification. Although there is an ongoing effort to defend models against these adversarial attacks, it is often difficult to reconcile the trade-offs in model accuracy and robustness to adversarial attacks. Jacobian regularization has been shown to improve the robustness of models against UAPs, whilst model ensembles have been widely adopted to improve both predictive performance and model robustness. In this work, we propose a novel approach, Jacobian Ensembles -a combination of Jacobian regularization and model ensembles to significantly increase the robustness against UAPs whilst maintaining or improving model accuracy. Our results show that Jacobian Ensembles achieves previously unseen levels of accuracy and robustness, greatly improving over previous methods that tend to skew towards only either accuracy or robustness.

show abstract

Shadow-Catcher: Looking into Shadows to Detect Ghost Objects in Autonomous Vehicle 3D Sensing

Cited by 11 publications

References 18 publications

Using 3D Shadows to Detect Object Hiding Attacks on Autonomous Vehicle Perception

Using 3D Shadows to Detect Object Hiding Attacks on Autonomous Vehicle Perception

Security Analysis of Camera-LiDAR Fusion Against Black-Box Attacks on Autonomous Vehicles

Jacobian Ensembles Improve Robustness Trade-offs to Adversarial Attacks

Contact Info

Product

Resources

About