Vision-based3d object detection, a cost-effective alternative to LidAR-based solutions, plays a crucial role in modern autonomous driving systems. Meanwhile, deep models have been proven susceptible to adversarial ex...
详细信息
Vision-based3d object detection, a cost-effective alternative to LidAR-based solutions, plays a crucial role in modern autonomous driving systems. Meanwhile, deep models have been proven susceptible to adversarial examples, and attacking detection models can lead to serious driving consequences. Most previous adversarial attacks targeted 2ddetectors by placing the patch in a specific region within the object's bounding box in the image, allowing it to evade detection. However, attacking 3ddetector is more difficult because the adversary may be observed from different viewpoints anddistances, and there is a lack of effective methods to differentiably render the 3d space poster onto the image. In this paper, we propose a novel attack setting where a carefully crafted adversarial poster (looks like meaningless graffiti) is learned and pasted on the road surface, inducing the vision-based3ddetectors to perceive a non-existent object. We show that even a single 2d poster is sufficient to deceive the 3ddetector with the desired attack effect, and the poster is universal, which is effective across various scenes, viewpoints, anddistances. To generate the poster, an image-3d applying algorithm is devised to establish the pixel-wise mapping relationship between the image area and the 3d space poster so that the poster can be optimized through standard backpropagation. Moreover, a ground-truth masked optimization strategy is presented to effectively learn the poster without interference from scene objects. Extensive results including real-world experiments validate the effectiveness of our adversarial attack. The transferability anddefense strategy are also investigated to comprehensively understand the proposed attack.
暂无评论