[Paper Review] APARATE: Adaptive Adversarial Patch for CNN-based Monocular Depth Estimation for Autonomous Navigation

Amira Guesmi, Muhammad Abdullah Hanif+2 more|arXiv (Cornell University)|Mar 2, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes APARATE, a novel adaptive adversarial patch that selectively disrupts monocular depth estimation (MDE) in autonomous systems by causing complete object disappearance or severe depth distortion. It achieves a mean depth error exceeding 0.5 across 99% of the target region in CNN-based MDE and 0.34 across 94% in Transformer-based models, with robustness against input transformation defenses.

ABSTRACT

In recent times, monocular depth estimation (MDE) has experienced significant advancements in performance, largely attributed to the integration of innovative architectures, i.e., convolutional neural networks (CNNs) and Transformers. Nevertheless, the susceptibility of these models to adversarial attacks has emerged as a noteworthy concern, especially in domains where safety and security are paramount. This concern holds particular weight for MDE due to its critical role in applications like autonomous driving and robotic navigation, where accurate scene understanding is pivotal. To assess the vulnerability of CNN-based depth prediction methods, recent work tries to design adversarial patches against MDE. However, the existing approaches fall short of inducing a comprehensive and substantially disruptive impact on the vision system. Instead, their influence is partial and confined to specific local areas. These methods lead to erroneous depth predictions only within the overlapping region with the input image, without considering the characteristics of the target object, such as its size, shape, and position. In this paper, we introduce a novel adversarial patch named APARATE. This patch possesses the ability to selectively undermine MDE in two distinct ways: by distorting the estimated distances or by creating the illusion of an object disappearing from the perspective of the autonomous system. Notably, APARATE is designed to be sensitive to the shape and scale of the target object, and its influence extends beyond immediate proximity. APARATE, results in a mean depth estimation error surpassing $0.5$, significantly impacting as much as $99\%$ of the targeted region when applied to CNN-based MDE models. Furthermore, it yields a significant error of $0.34$ and exerts substantial influence over $94\%$ of the target region in the context of Transformer-based MDE.

Motivation & Objective

• To address the critical vulnerability of CNN- and Transformer-based monocular depth estimation (MDE) models to physical adversarial attacks in autonomous navigation.
• To develop an adversarial patch that fully obscures target objects or distorts depth perception across the entire object region, not just overlapping areas.
• To ensure the patch is adaptive to object size, shape, and distance from the camera, enabling generalization across varying object classes and positions.
• To design a patch that remains effective under common defense mechanisms such as JPEG compression, median blur, and Gaussian noise.
• To demonstrate the practical threat of adversarial patches in real-world autonomous systems by achieving high error rates with minimal visual perturbation.

Proposed method

• The method introduces a penalized loss function that enhances adversarial patch effectiveness and expands its influence beyond the patch-input overlap region.
• It employs an automated patch placement mechanism that aligns the patch with the target object’s shape and scale, avoiding random or irrelevant placements.
• The patch is optimized end-to-end to maximize depth estimation error across the entire target object, ensuring full occlusion or distortion.
• The framework is trained to be robust to physical-world transformations, including image compression, blurring, and noise, by simulating these during optimization.
• The attack is applied to both CNN-based and Vision Transformer-based MDE models, demonstrating generalization across different architectures.
• The method is evaluated on public road datasets, focusing on cars and pedestrians as representative target objects.

Experimental results

Research questions

• RQ1 Can an adversarial patch be designed to fully obscure an object in monocular depth estimation, rather than only distorting a small overlapping region?
• RQ2 How effective is the patch in inducing high depth estimation errors across the entire target object, regardless of object size, shape, or distance from the camera?
• RQ3 To what extent does the patch remain effective when subjected to common input-level defense techniques such as JPEG compression, median blur, and Gaussian noise?
• RQ4 Can the patch be generalized across different object categories (e.g., cars, pedestrians) without retraining?
• RQ5 Does the patch’s performance degrade significantly under physical-world transformations, or is it robust to such defenses?

Key findings

• APARATE achieves a mean depth estimation error exceeding 0.5 across 99% of the target region in CNN-based MDE models, indicating near-total disruption of depth prediction.
• For Transformer-based MDE, the patch induces a mean depth error of 0.34, affecting approximately 94% of the target region, demonstrating strong generalization across architectures.
• Even under defense mechanisms like JPEG compression (quality 30), median blur (radius 20), and Gaussian noise (σ=0.1), the patch maintains a mean error of 0.2, showing resilience to input transformations.
• The median blur defense significantly degrades baseline MDE performance, but APARATE still achieves a mean error of 0.13, indicating its effectiveness persists even when defenses degrade the model.
• The patch remains effective across varying object sizes, shapes, and distances from the camera, demonstrating its adaptability and generalization capability.
• The attack is robust to physical-world transformations, with minimal performance drop under common defense techniques, highlighting the real-world threat of such adversarial patches.