Adversarial Attacks against LiDAR Semantic Segmentation in Autonomous Driving
Adversarial Attacks against LiDAR Semantic Segmentation in Autonomous Driving
复制标题
DOI：
10.1145/3485730.3485935
复制
发表时间：
2021-11
期刊：
影响因子：
--
通讯作者：
Yi Zhu;Chenglin Miao;Foad Hajiaghajani;Mengdi Huai;Lu Su;Chunming Qiao
中科院分区：
文献类型：
--
作者：
Yi Zhu;Chenglin Miao;Foad Hajiaghajani;Mengdi Huai;Lu Su;Chunming Qiao
如今，大多数自动驾驶汽车（AV）依靠LiDAR（光探测和测距）感知来获取有关其周围环境的准确信息。在基于LiDAR的感知系统中，语义分割起着至关重要的作用，因为它可以根据人类的感知将LiDAR点云划分为有意义的区域，并为AV提供对驾驶环境的语义理解。然而，现有语义分割模型的隐含假设是它们在可靠和安全的环境中执行，这在实践中可能不是真的。在本文中，我们研究了自动驾驶中针对LiDAR语义分割的对抗性攻击。具体来说，我们提出了一种新的对抗性攻击框架，基于该框架，攻击者可以通过放置一些简单的对象（例如，纸板和路标）。我们进行了广泛的现实世界的实验，以评估我们提出的攻击框架的性能。实验结果表明，我们的攻击可以达到90%以上的成功率在现实世界的驾驶环境。据我们所知，这是第一次研究针对LiDAR点云语义分割的物理上可实现的对抗性攻击，并进行了真实世界的评估。
Today, most autonomous vehicles (AVs) rely on LiDAR (Light Detection and Ranging) perception to acquire accurate information about their immediate surroundings. In LiDAR-based perception systems, semantic segmentation plays a critical role as it can divide LiDAR point clouds into meaningful regions according to human perception and provide AVs with semantic understanding of the driving environments. However, an implicit assumption for existing semantic segmentation models is that they are performed in a reliable and secure environment, which may not be true in practice. In this paper, we investigate adversarial attacks against LiDAR semantic segmentation in autonomous driving. Specifically, we propose a novel adversarial attack framework based on which the attacker can easily fool LiDAR semantic segmentation by placing some simple objects (e.g., cardboard and road signs) at some locations in the physical space. We conduct extensive real-world experiments to evaluate the performance of our proposed attack framework. The experimental results show that our attack can achieve more than 90% success rate in real-world driving environments. To the best of our knowledge, this is the first study on physically realizable adversarial attacks against LiDAR point cloud semantic segmentation with real-world evaluations.