Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures

Abstract

Perception plays a pivotal role in autonomous driving systems, which utilizes onboard sensors like cameras and LiDARs (Light Detection and Ranging) to assess surroundings. Recent studies have demonstrated that LiDAR-based perception is vulnerable to spoofing attacks, in which adversaries spoof a fake vehicle in front of a victim self-driving car by strategically transmitting laser signals to the victim's LiDAR sensor. However, existing attacks suffer from effectiveness and generality limitations. In this work, we perform the first study to explore the general vulnerability of current LiDAR-based perception architectures and discover that the ignored occlusion patterns in LiDAR point clouds make self-driving cars vulnerable to spoofing attacks. We construct the first black-box spoofing attack based on our identified vulnerability, which universally achieves around 80% mean success rates on all target models. We perform the first defense study, proposing CARLO to mitigate LiDAR spoofing attacks. CARLO detects spoofed data by treating ignored occlusion patterns as invariant physical features, which reduces the mean attack success rate to 5.5%. Meanwhile, we take the first step towards exploring a general architecture for robust LiDAR-based perception, and propose SVF that embeds the neglected physical features into end-to-end learning. SVF further reduces the mean attack success rate to around 2.3%.

18 pages, 27 figures, to be published in USENIX Security 2020

References in corpus (9)

• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Deep Continuous Fusion for Multi-Sensor 3D Object Detection
• Vehicle Detection from 3D Lidar Using Fully Convolutional Network
• PointSeg: Real-Time Semantic Segmentation Based on 3D LiDAR Point Cloud
• Adversarial Attack and Defense on Point Sets
• Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
• Patch Refinement -- Localized 3D Object Detection

Cited by in corpus (10)

• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• DriveFuzz: Discovering Autonomous Driving Bugs through Driving Quality-Guided Fuzzing
• Temporal Consistency Checks to Detect LiDAR Spoofing Attacks on Autonomous Vehicle Perception
• LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategies
• Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving
• Security Analysis of Camera-LiDAR Fusion Against Black-Box Attacks on Autonomous Vehicles
• AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehicles
• Fooling LiDAR Perception via Adversarial Trajectory Perturbation
• FakeSwarm: Improving Fake News Detection with Swarming Characteristics
• Adversarial Robustness of Deep Sensor Fusion Models