Fooling LiDAR Perception via Adversarial Trajectory Perturbation
Fooling LiDAR Perception via Adversarial Trajectory Perturbation
复制标题
DOI：
10.1109/iccv48922.2021.00780
复制
发表时间：
2021-03
期刊：
影响因子：
--
通讯作者：
Yiming Li;Congcong Wen;Felix Juefei-Xu;Chen Feng
中科院分区：
文献类型：
--
作者：
Yiming Li;Congcong Wen;Felix Juefei-Xu;Chen Feng
从移动的车辆上收集的激光雷达点云是其轨迹的函数，因为传感器的运动需要进行补偿以避免失真。当自动车辆将激光雷达点云发送到深度网络进行感知和规划时，运动补偿是否会因此成为这些网络中一个完全开放的后门，因为深度学习的对手漏洞和基于GPS的车辆轨迹估计都容易受到无线欺骗的影响？我们首次展示了这种可能性：不是直接攻击需要篡改原始LiDAR读数的点云坐标，而是只需对自动驾驶汽车的轨迹进行对抗性的小扰动欺骗，就足以使安全关键对象无法检测或检测到错误的位置。此外，还利用多项式弹道摄动实现了一种时间平滑和高度隐身的攻击。对3D目标检测的广泛实验表明，这种攻击不仅有效地降低了最先进的检测器的性能，而且还会转移到其他检测器，为社区拉起了危险信号。代码可在https://ai4ce.github.io/FLAT/.上找到
LiDAR point clouds collected from a moving vehicle are functions of its trajectories, because the sensor motion needs to be compensated to avoid distortions. When autonomous vehicles are sending LiDAR point clouds to deep networks for perception and planning, could the motion compensation consequently become a wide-open backdoor in those networks, due to both the adversarial vulnerability of deep learning and GPS-based vehicle trajectory estimation that is susceptible to wireless spoofing? We demonstrate such possibilities for the first time: instead of directly attacking point cloud coordinates which requires tampering with the raw LiDAR readings, only adversarial spoofing of a self-driving car’s trajectory with small perturbations is enough to make safety-critical objects undetectable or detected with incorrect positions. Moreover, polynomial trajectory perturbation is developed to achieve a temporally-smooth and highly-imperceptible attack. Extensive experiments on 3D object detection have shown that such attacks not only lower the performance of the state-of-the-art detectors effectively, but also transfer to other detectors, raising a red flag for the community. The code is available on https://ai4ce.github.io/FLAT/.