版权所有:内蒙古大学图书馆 技术提供:维普资讯• 智图
内蒙古自治区呼和浩特市赛罕区大学西街235号 邮编: 010021
作者机构:Xi An Jiao Tong Univ Sch Informat & Commun Engn Shaanxi Key Lab Deep Space Explorat Intelligent In Xian 710049 Peoples R China Xi An Jiao Tong Univ Sch Cyber Sci & Engn MOE Key Lab Intelligent Networks & Network Secur Xian 710049 Peoples R China
出 版 物:《IEEE TRANSACTIONS ON IMAGE PROCESSING》 (IEEE Trans Image Process)
年 卷 期:2025年第34卷
页 面:538-551页
核心收录:
学科分类:0808[工学-电气工程] 08[工学] 0812[工学-计算机科学与技术(可授工学、理学学位)]
基 金:National Science and Technology Major Project [2022ZD0115803] Natural Science Basic Research Plan in Shaanxi Province of China [xzy022023053] Key Research and Development Program of Shaanxi Province [2024GH-ZDXM-41]
主 题:Three-dimensional printing Detectors Roads Object detection Autonomous vehicles Pipelines Feature extraction Visualization Solid modeling Perturbation methods Physical adversarial attack visual 3D detection universal patch adversarial robustness
摘 要:Vision-based 3D object detection, a cost-effective alternative to LiDAR-based solutions, plays a crucial role in modern autonomous driving systems. Meanwhile, deep models have been proven susceptible to adversarial examples, and attacking detection models can lead to serious driving consequences. Most previous adversarial attacks targeted 2D detectors by placing the patch in a specific region within the object s bounding box in the image, allowing it to evade detection. However, attacking 3D detector is more difficult because the adversary may be observed from different viewpoints and distances, and there is a lack of effective methods to differentiably render the 3D space poster onto the image. In this paper, we propose a novel attack setting where a carefully crafted adversarial poster (looks like meaningless graffiti) is learned and pasted on the road surface, inducing the vision-based 3D detectors to perceive a non-existent object. We show that even a single 2D poster is sufficient to deceive the 3D detector with the desired attack effect, and the poster is universal, which is effective across various scenes, viewpoints, and distances. To generate the poster, an image-3D applying algorithm is devised to establish the pixel-wise mapping relationship between the image area and the 3D space poster so that the poster can be optimized through standard backpropagation. Moreover, a ground-truth masked optimization strategy is presented to effectively learn the poster without interference from scene objects. Extensive results including real-world experiments validate the effectiveness of our adversarial attack. The transferability and defense strategy are also investigated to comprehensively understand the proposed attack.