[Paper Review] Adversarial Objects Against LiDAR-Based Autonomous Driving Systems

Yulong Cao, Chaowei Xiao+5 more|arXiv (Cornell University)|Jul 11, 2019

Adversarial Robustness in Machine LearningComputer Science23 references63 citations

TL;DR

The paper introduces LiDAR-Adv, an end-to-end differentiable approach to generate physically plausible adversarial objects that can evade LiDAR-based autonomous driving detectors, and demonstrates both whitebox and blackbox attacks, including real-world 3D-printed tests on the Baidu Apollo platform.

ABSTRACT

Deep neural networks (DNNs) are found to be vulnerable against adversarial examples, which are carefully crafted inputs with a small magnitude of perturbation aiming to induce arbitrarily incorrect predictions. Recent studies show that adversarial examples can pose a threat to real-world security-critical applications: a "physical adversarial Stop Sign" can be synthesized such that the autonomous driving cars will misrecognize it as others (e.g., a speed limit sign). However, these image-space adversarial examples cannot easily alter 3D scans of widely equipped LiDAR or radar on autonomous vehicles. In this paper, we reveal the potential vulnerabilities of LiDAR-based autonomous driving detection systems, by proposing an optimization based approach LiDAR-Adv to generate adversarial objects that can evade the LiDAR-based detection system under various conditions. We first show the vulnerabilities using a blackbox evolution-based algorithm, and then explore how much a strong adversary can do, using our gradient-based approach LiDAR-Adv. We test the generated adversarial objects on the Baidu Apollo autonomous driving platform and show that such physical systems are indeed vulnerable to the proposed attacks. We also 3D-print our adversarial objects and perform physical experiments to illustrate that such vulnerability exists in the real world. Please find more visualizations and results on the anonymous website: https://sites.google.com/view/lidar-adv.

Motivation & Objective

• Investigate vulnerabilities of LiDAR-based autonomous driving detection systems to adversarial objects.
• Develop an end-to-end framework (LiDAR-Adv) to generate physically plausible adversarial 3D objects.
• Enable attacks under multiple goals (hiding objects and changing labels) while preserving realism and robustness.
• Evaluate attacks in simulation and on a production-level autonomous driving platform with real-world 3D-printed objects.

Proposed method

• Formulate adversarial objectives on the LiDAR-based detector pipeline (preprocessing, model M, and post-processing).
• Develop a differentiable LiDAR renderer R to simulate LiDAR point cloud generation from a 3D object S, enabling gradient-based optimization.
• Create a differentiable proxy for the non-differentiable 2D feature aggregation Phi to allow end-to-end optimization.
• Optimize 3D vertex perturbations of S via a composite loss L = L_adv + lambda L_r, where L_r enforces realism (Laplacian and L2 distance) and L_adv drives the attack.
• Construct two attack modes: hide an object by reducing detection confidence and change the detected label to a target class.
• Provide a black-box attack via an evolution-based search when model internals are not accessible.
• Test robustness by generating universal adversarial objects across multiple poses and orientations, then physically 3D-print and test on a moving vehicle.

Experimental results

Research questions

• RQ1 Can physically plausible 3D object perturbations fool LiDAR-based detectors in real-world settings?
• RQ2 How can gradient-based optimization be applied when the LiDAR preprocessing and post-processing steps are non-differentiable?
• RQ3 Do adversarial objects remain effective under various object positions, orientations, and platform conditions (robustness)?
• RQ4 Can adversarial objects cause hiding or label-changing failures in an industry-grade autonomous driving system (Baidu Apollo)?

Key findings

• LiDAR-Adv achieves a higher attack success rate than black-box evolution-based methods (e.g., 71% vs. 62% for 50 cm objects; 51% vs. 36% for 75 cm objects).
• The generated adversarial objects are smoother than those from the evolution-based method.
• Adversarial objects can change detector outputs to misclassify as a target (e.g., mis-detected as Pedestrian).
• Robust adversarial objects maintain high effectiveness across unseen positions/orientations (e.g., 96/100 success under certain unseen conditions).
• 3D-printed adversarial objects fail to be detected by the LiDAR-based detector in many frames during real-drive tests, demonstrating real-world threat.