Towards Universal Physical Attacks On Cascaded Camera-Lidar 3D Object Detection Models

Abstract

We propose a universal and physically realizable adversarial attack on a cascaded multi-modal deep learning network (DNN), in the context of self-driving cars. DNNs have achieved high performance in 3D object detection, but they are known to be vulnerable to adversarial attacks. These attacks have been heavily investigated in the RGB image domain and more recently in the point cloud domain, but rarely in both domains simultaneously - a gap to be filled in this paper. We use a single 3D mesh and differentiable rendering to explore how perturbing the mesh's geometry and texture can reduce the robustness of DNNs to adversarial attacks. We attack a prominent cascaded multi-modal DNN, the Frustum-Pointnet model. Using the popular KITTI benchmark, we showed that the proposed universal multi-modal attack was successful in reducing the model's ability to detect a car by nearly 73%. This work can aid in the understanding of what the cascaded RGB-point cloud DNN learns and its vulnerability to adversarial attacks.

References in corpus (8)

• Explaining and Harnessing Adversarial Examples
• YOLOv3: An Incremental Improvement
• Frustum ConvNet: Sliding Frustums to Aggregate Local Point-Wise Features for Amodal 3D Object Detection
• Accelerating 3D Deep Learning with PyTorch3D
• Soft Rasterizer: Differentiable Rendering for Unsupervised Single-View Mesh Reconstruction
• Adversarial Attack and Defense on Point Sets
• Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
• Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer

Cited by in corpus (3)

• Benchmarking Robustness of AI-Enabled Multi-sensor Fusion Systems: Challenges and Opportunities
• MultiTest: Physical-Aware Object Insertion for Testing Multi-sensor Fusion Perception Systems
• On-Demand Scenario Generation for Testing Automated Driving Systems