[Paper Review] Adversarial Attack on Radar-based Environment Perception Systems

Amira Guesmi, Ihsen Alouani|arXiv (Cornell University)|Nov 2, 2022

Geophysical Methods and Applications4 citations

TL;DR

This paper proposes a-RNA, a novel adversarial radio noise attack targeting UWB radar-based environment perception systems. It generates input-agnostic, shift-robust, and spectral-domain-robust adversarial noise that evades filtering and spectrum-sensing defenses, demonstrating practical feasibility in real-world line-of-sight conditions with high success rates against DNN-based obstacle recognition.

ABSTRACT

Due to their robustness to degraded capturing conditions, radars are widely used for environment perception, which is a critical task in applications like autonomous vehicles. More specifically, Ultra-Wide Band (UWB) radars are particularly efficient for short range settings as they carry rich information on the environment. Recent UWB-based systems rely on Machine Learning (ML) to exploit the rich signature of these sensors. However, ML classifiers are susceptible to adversarial examples, which are created from raw data to fool the classifier such that it assigns the input to the wrong class. These attacks represent a serious threat to systems integrity, especially for safety-critical applications. In this work, we present a new adversarial attack on UWB radars in which an adversary injects adversarial radio noise in the wireless channel to cause an obstacle recognition failure. First, based on signals collected in real-life environment, we show that conventional attacks fail to generate robust noise under realistic conditions. We propose a-RNA, i.e., Adversarial Radio Noise Attack to overcome these issues. Specifically, a-RNA generates an adversarial noise that is efficient without synchronization between the input signal and the noise. Moreover, a-RNA generated noise is, by-design, robust against pre-processing countermeasures such as filtering-based defenses. Moreover, in addition to the undetectability objective by limiting the noise magnitude budget, a-RNA is also efficient in the presence of sophisticated defenses in the spectral domain by introducing a frequency budget. We believe this work should alert about potentially critical implementations of adversarial attacks on radar systems that should be taken seriously.

Motivation & Objective

• To address the lack of practical adversarial attacks on UWB radar-based environment perception systems, which are increasingly used in safety-critical applications like autonomous vehicles.
• To overcome the limitations of conventional adversarial attacks that fail under real-world conditions such as signal desynchronization and pre-processing defenses.
• To design an input-agnostic adversarial noise generation method that is robust to time delays, filtering, and spectral-domain defenses without requiring synchronization.
• To ensure the adversarial noise remains undetectable by limiting its magnitude and frequency budget while maintaining high attack success rate.
• To demonstrate the feasibility of real-world physical adversarial attacks on UWB radar systems under line-of-sight propagation conditions.

Proposed method

• Proposes a-RNA (Adversarial Radio Noise Attack), a novel framework for generating adversarial radio noise that is input-agnostic and robust to time delays (shift-robustness).
• Introduces a noise generation strategy that aggregates random noise locations during training to ensure robustness against signal desynchronization.
• Employs a frequency budget constraint to enhance robustness against spectral-domain defenses such as filtering and spectrum sensing.
• Designs the adversarial noise to be undetectable by limiting its magnitude and power spectral density to avoid triggering detection mechanisms.
• Uses a universal patch-based approach to generate adversarial noise that can be applied across diverse input signals without retraining.
• Validates the attack under realistic wireless propagation conditions using real-world UWB signal data collected in controlled environments.

Experimental results

Research questions

• RQ1 Can adversarial noise be generated for UWB radar systems that remain effective despite signal desynchronization and timing delays?
• RQ2 Can adversarial noise be made robust against common defense mechanisms such as filtering and spectrum sensing?
• RQ3 Is it possible to generate undetectable adversarial noise that maintains high attack success rate in real-world wireless environments?
• RQ4 How effective is the proposed attack under practical constraints such as line-of-sight propagation and path loss?
• RQ5 Can the attack be applied universally across different input signals without requiring input-specific perturbations?

Key findings

• The proposed a-RNA attack achieves high success rates in fooling DNN-based obstacle recognition systems in UWB radar environments, even under realistic signal delays.
• Conventional adversarial attacks fail under real-world conditions due to desynchronization, highlighting the need for shift-robust noise generation.
• a-RNA-generated noise remains effective against filtering-based defenses and spectrum-sensing mechanisms due to its frequency budget design.
• The attack is undetectable under magnitude and spectral constraints, making it suitable for real-world deployment.
• The attack remains effective across varying distances in line-of-sight conditions when noise power is adjusted to compensate for path loss.
• To our knowledge, this is the first work to demonstrate a practical, input-agnostic, and robust adversarial attack on UWB radar systems with real-world feasibility.