[论文解读] Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures

Jiachen Sun, Yulong Cao+2 more|arXiv (Cornell University)|Jun 30, 2020

Adversarial Robustness in Machine Learning参考文献 54被引用 82

一句话总结

这篇论文揭示了基于 LiDAR 的感知模型对利用被忽略的遮挡模式的黑盒欺骗攻击的一般性脆弱性，并提出防御 CARLO 和 SVF，显著降低攻击成功率。

ABSTRACT

Perception plays a pivotal role in autonomous driving systems, which utilizes onboard sensors like cameras and LiDARs (Light Detection and Ranging) to assess surroundings. Recent studies have demonstrated that LiDAR-based perception is vulnerable to spoofing attacks, in which adversaries spoof a fake vehicle in front of a victim self-driving car by strategically transmitting laser signals to the victim's LiDAR sensor. However, existing attacks suffer from effectiveness and generality limitations. In this work, we perform the first study to explore the general vulnerability of current LiDAR-based perception architectures and discover that the ignored occlusion patterns in LiDAR point clouds make self-driving cars vulnerable to spoofing attacks. We construct the first black-box spoofing attack based on our identified vulnerability, which universally achieves around 80% mean success rates on all target models. We perform the first defense study, proposing CARLO to mitigate LiDAR spoofing attacks. CARLO detects spoofed data by treating ignored occlusion patterns as invariant physical features, which reduces the mean attack success rate to 5.5%. Meanwhile, we take the first step towards exploring a general architecture for robust LiDAR-based perception, and propose SVF that embeds the neglected physical features into end-to-end learning. SVF further reduces the mean attack success rate to around 2.3%.

研究动机与目标

• 识别当前基于 LiDAR 的三维目标检测架构（基于 BEV、基于体素、和逐点）中的一般性脆弱性。
• 演示一种在多个模型上均能取得高成功率的黑盒对抗传感器攻击。
• 开发模型无关的和架构级别的防御来缓解 LiDAR 欺骗攻击。
• 提出 sequential view fusion (SVF) 以在不牺牲性能的情况下提升端到端鲁棒性。

提出的方法

• 分析 LiDAR 点云中模型忽略的遮挡相关不变性。
• 构造一种利用遮挡和稀疏性模式的黑盒欺骗攻击，以欺骗前方靠近的车辆。
• 在三种模型设计（基于 BEV、基于体素、逐点）上，使用 KITTI 派生数据来评估攻击成功率。
• 提出 CARLO，一种模型无关的防御，利用被忽略的遮挡模式作为不变特征。
• 开发 SVF，一种顺序融合架构，在端到端学习中更好地利用前视特征。

实验结果

研究问题

• RQ1 当前基于 LiDAR 的感知模型是否在 BEV 基、体素基和逐点设计中学习到 LiDAR 点云中的遮挡信息？
• RQ2 一种通用的黑盒欺骗攻击是否能在不同的 LiDAR 感知模型中实现高成功率？
• RQ3 模型无关的防御和架构级设计是否能在不削弱检测性能的前提下降低欺骗成功率？
• RQ4 相较于现有融合方法，顺序视图融合是否能提升对 LiDAR 欺骗攻击的鲁棒性？

主要发现

• 黑盒欺骗攻击在 BEV 基、基于体素和逐点模型上平均成功率约为 80%。
• CARLO 防御将所有目标模型的平均攻击成功率降至 5.5%，且不影响原始检测性能。
• SVF 进一步将平均攻击成功率降至约 2.3%，并且对白盒与自适应攻击具有鲁棒性。
• 该攻击利用两种遮挡模式（互遮挡和内遮挡）来设计最小点数的欺骗轨迹，从而骗过检测器。
• 实验使用了大约 15,000 个 KITTI 派生样本来评估攻击和防御。