Adversarial Objects Against LiDAR-Based Autonomous Driving Systems

Abstract

Deep neural networks (DNNs) are found to be vulnerable against adversarial examples, which are carefully crafted inputs with a small magnitude of perturbation aiming to induce arbitrarily incorrect predictions. Recent studies show that adversarial examples can pose a threat to real-world security-critical applications: a "physical adversarial Stop Sign" can be synthesized such that the autonomous driving cars will misrecognize it as others (e.g., a speed limit sign). However, these image-space adversarial examples cannot easily alter 3D scans of widely equipped LiDAR or radar on autonomous vehicles. In this paper, we reveal the potential vulnerabilities of LiDAR-based autonomous driving detection systems, by proposing an optimization based approach LiDAR-Adv to generate adversarial objects that can evade the LiDAR-based detection system under various conditions. We first show the vulnerabilities using a blackbox evolution-based algorithm, and then explore how much a strong adversary can do, using our gradient-based approach LiDAR-Adv. We test the generated adversarial objects on the Baidu Apollo autonomous driving platform and show that such physical systems are indeed vulnerable to the proposed attacks. We also 3D-print our adversarial objects and perform physical experiments to illustrate that such vulnerability exists in the real world. Please find more visualizations and results on the anonymous website: https://sites.google.com/view/lidar-adv.

References in corpus (8)

• Adam: A Method for Stochastic Optimization
• Synthesizing Robust Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Spatially Transformed Adversarial Examples
• Generating Adversarial Examples with Adversarial Networks
• Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation
• Data Poisoning Attack against Unsupervised Node Embedding Methods
• Generating 3D Adversarial Point Clouds

Cited by in corpus (21)

• AdvPC: Transferable Adversarial Perturbations on 3D Point Clouds
• Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures
• Towards robust sensing for Autonomous Vehicles: An adversarial perspective
• Learning perturbation sets for robust machine learning
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• IF-Defense: 3D Adversarial Point Cloud Defense via Implicit Function based Restoration
• Towards Universal Physical Attacks On Cascaded Camera-Lidar 3D Object Detection Models
• Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving
• Physically Realizable Adversarial Examples for LiDAR Object Detection
• AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehicles
• Jacobian Regularization for Mitigating Universal Adversarial Perturbations
• Who is in Control? Practical Physical Layer Attack and Defense for mmWave based Sensing in Autonomous Vehicles
• Enhanced Adversarial Strategically-Timed Attacks against Deep Reinforcement Learning
• Adversarial Online Learning with Variable Plays in the Pursuit-Evasion Game: Theoretical Foundations and Application in Connected and Automated Vehicle Cybersecurity
• Adversarial shape perturbations on 3D point clouds
• Nudge Attacks on Point-Cloud DNNs
• Meta Adversarial Training against Universal Patches
• Real-time Detection of Practical Universal Adversarial Perturbations
• LG-GAN: Label Guided Adversarial Network for Flexible Targeted Attack of Point Cloud-based Deep Networks
• Dual Head Adversarial Training
• Adversarial Robustness of Deep Sensor Fusion Models