Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks

Abstract

In Autonomous Driving (AD) systems, perception is both security and safety critical. Despite various prior studies on its security issues, all of them only consider attacks on camera- or LiDAR-based AD perception alone. However, production AD systems today predominantly adopt a Multi-Sensor Fusion (MSF) based design, which in principle can be more robust against these attacks under the assumption that not all fusion sources are (or can be) attacked at the same time. In this paper, we present the first study of security issues of MSF-based perception in AD systems. We directly challenge the basic MSF design assumption above by exploring the possibility of attacking all fusion sources simultaneously. This allows us for the first time to understand how much security guarantee MSF can fundamentally provide as a general defense strategy for AD perception. We formulate the attack as an optimization problem to generate a physically-realizable, adversarial 3D-printed object that misleads an AD system to fail in detecting it and thus crash into it. We propose a novel attack pipeline that addresses two main design challenges: (1) non-differentiable target camera and LiDAR sensing systems, and (2) non-differentiable cell-level aggregated features popularly used in LiDAR-based AD perception. We evaluate our attack on MSF included in representative open-source industry-grade AD systems in real-world driving scenarios. Our results show that the attack achieves over 90% success rate across different object types and MSF. Our attack is also found stealthy, robust to victim positions, transferable across MSF algorithms, and physical-world realizable after being 3D-printed and captured by LiDAR and camera devices. To concretely assess the end-to-end safety impact, we further perform simulation evaluation and show that it can cause a 100% vehicle collision rate for an industry-grade AD system.

arXiv commentAccepted by IEEE S&P 2021

References in corpus (34)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• A Survey of Autonomous Driving: Common Practices and Emerging Technologies
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• Synthesizing Robust Adversarial Examples
• Certified Adversarial Robustness via Randomized Smoothing
• Fast is better than free: Revisiting adversarial training
• Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving
• Using Pre-Training Can Improve Model Robustness and Uncertainty
• Deep Continuous Fusion for Multi-Sensor 3D Object Detection
• A study of the effect of JPG compression on adversarial images
• Spatially Transformed Adversarial Examples
• Generating Adversarial Examples with Adversarial Networks
• MagNet: a Two-Pronged Defense against Adversarial Examples
• DeepTest: Automated Testing of Deep-Neural-Network-driven Autonomous Cars
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• End-to-end Learning of Multi-sensor 3D Tracking by Detection
• Adversarial Patch
• Adversarial Examples that Fool Detectors
• Deep Steering: Learning End-to-End Driving Model from Spatial and Temporal Visual Cues
• Laplacian-Steered Neural Style Transfer
• Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures
• Adversarial camera stickers: A physical camera-based attack on deep learning systems
• Characterizing Attacks on Deep Reinforcement Learning
• Deep Learning for 3D Point Clouds: A Survey
• Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation
• Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors
• Bypassing Feature Squeezing by Increasing Adversary Strength
• SoK: Certified Robustness for Deep Neural Networks
• Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors
• SPAA: Stealthy Projector-based Adversarial Attacks on Deep Image Classifiers
• ShapeAdv: Generating Shape-Aware Adversarial 3D Point Clouds
• Rearchitecting Classification Frameworks For Increased Robustness

Cited by in corpus (15)

• 3D-VField: Adversarial Augmentation of Point Clouds for Domain Generalization in 3D Object Detection
• Benchmarking Robustness of AI-Enabled Multi-sensor Fusion Systems: Challenges and Opportunities
• LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategies
• Temporal Consistency Checks to Detect LiDAR Spoofing Attacks on Autonomous Vehicle Perception
• Benchmarking and Improving Bird's Eye View Perception Robustness in Autonomous Driving
• Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehicles
• MultiTest: Physical-Aware Object Insertion for Testing Multi-sensor Fusion Perception Systems
• Self-supervised Adversarial Training of Monocular Depth Estimation against Physical-World Attacks
• Security Analysis of Camera-LiDAR Fusion Against Black-Box Attacks on Autonomous Vehicles
• Recovery from Adversarial Attacks in Cyber-physical Systems: Shallow, Deep and Exploratory Works
• On-Demand Scenario Generation for Testing Automated Driving Systems
• Diagnosis-guided Attack Recovery for Securing Robotic Vehicles from Sensor Deception Attacks
• 3D Adversarial Augmentations for Robust Out-of-Domain Predictions
• Achieving the Safety and Security of the End-to-End AV Pipeline
• Towards Robustness Analysis of E-Commerce Ranking System