[Paper Review] Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures

Jiachen Sun, Yulong Cao+2 more|arXiv (Cornell University)|Jun 30, 2020

Adversarial Robustness in Machine LearningComputer Science54 references82 citations

TL;DR

The paper exposes a general vulnerability in LiDAR-based perception models to black-box spoofing attacks that exploit ignored occlusion patterns, and presents defenses CARLO and SVF to markedly reduce attack success rates.

ABSTRACT

Perception plays a pivotal role in autonomous driving systems, which utilizes onboard sensors like cameras and LiDARs (Light Detection and Ranging) to assess surroundings. Recent studies have demonstrated that LiDAR-based perception is vulnerable to spoofing attacks, in which adversaries spoof a fake vehicle in front of a victim self-driving car by strategically transmitting laser signals to the victim's LiDAR sensor. However, existing attacks suffer from effectiveness and generality limitations. In this work, we perform the first study to explore the general vulnerability of current LiDAR-based perception architectures and discover that the ignored occlusion patterns in LiDAR point clouds make self-driving cars vulnerable to spoofing attacks. We construct the first black-box spoofing attack based on our identified vulnerability, which universally achieves around 80% mean success rates on all target models. We perform the first defense study, proposing CARLO to mitigate LiDAR spoofing attacks. CARLO detects spoofed data by treating ignored occlusion patterns as invariant physical features, which reduces the mean attack success rate to 5.5%. Meanwhile, we take the first step towards exploring a general architecture for robust LiDAR-based perception, and propose SVF that embeds the neglected physical features into end-to-end learning. SVF further reduces the mean attack success rate to around 2.3%.

Motivation & Objective

• Identify general vulnerabilities in current LiDAR-based 3D object detection architectures (BEV-based, voxel-based, and point-wise).
• Demonstrate a black-box adversarial sensor attack that achieves high success across multiple models.
• Develop model-agnostic and architecture-level defenses to mitigate LiDAR spoofing attacks.
• Propose sequential view fusion (SVF) to improve end-to-end robustness without sacrificing performance.

Proposed method

• Analyze occlusion-related invariants in LiDAR point clouds that models ignore.
• Construct a black-box spoofing attack using occlusion and sparsity patterns to spoof front-near vehicles.
• Evaluate attack success on three model designs (BEV-based, voxel-based, point-wise) with KITTI-derived data.
• Propose CARLO, a model-agnostic defense leveraging ignored occlusion patterns as invariant features.
• Develop SVF, a sequential fusion architecture that better utilizes front-view features in end-to-end learning.

Experimental results

Research questions

• RQ1 Do current LiDAR-based perception models learn occlusion information in LiDAR point clouds across BEV-based, voxel-based, and point-wise designs?
• RQ2 Can a general black-box spoofing attack achieve high success across diverse LiDAR perception models?
• RQ3 Can model-agnostic defenses and architecture-level designs reduce spoofing success while preserving detection performance?
• RQ4 Does sequential view fusion improve robustness against LiDAR spoofing attacks compared to existing fusion approaches?

Key findings

• Black-box spoofing attacks achieve around 80% mean success rate across BEV-based, voxel-based, and point-wise models.
• CARLO defense reduces mean attack success rate to 5.5% on all target models without sacrificing original detection performance.
• SVF further reduces mean attack success rate to about 2.3% and is resilient to white-box and adaptive attacks.
• The attack leverages two occlusion patterns (inter-occlusion and intra-occlusion) to craft minimal-point spoofing traces that fool detectors.
• Experiments used around 15,000 KITTI-derived samples to evaluate attacks and defenses.