CoChat
Sign Up
PreprintCited by 102Adversarial Robustness in Machine LearningAutonomous Vehicle Technology and SafetySecurity and Verification in Computing

Adversarial objects against lidar-based autonomous driving systems

Open access
Cao, Yulong, Xiao, Chaowei, Yang, Dawei, Fang, Jing, Yang, Ruigang, Liu, Mingyan, Li, Bo·2019·arXiv
DOI 10.48550/arxiv.1907.05418arXiv 1907.05418
Open this paper in CoChat — free accountOpen PDF

Abstract

Deep neural networks (DNNs) are found to be vulnerable against adversarial examples, which are carefully crafted inputs with a small magnitude of perturbation aiming to induce arbitrarily incorrect predictions. Recent studies show that adversarial examples can pose a threat to real-world security-critical applications: a "physical adversarial Stop Sign" can be synthesized such that the autonomous driving cars will misrecognize it as others (e.g., a speed limit sign). However, these image-space adversarial examples cannot easily alter 3D scans of widely equipped LiDAR or radar on autonomous vehicles. In this paper, we reveal the potential vulnerabilities of LiDAR-based autonomous driving detection systems, by proposing an optimization based approach LiDAR-Adv to generate adversarial objects that can evade the LiDAR-based detection system under various conditions. We first show the vulnerabilities using a blackbox evolution-based algorithm, and then explore how much a strong adversary can do, using our gradient-based approach LiDAR-Adv. We test the generated adversarial objects on the Baidu Apollo autonomous driving platform and show that such physical systems are indeed vulnerable to the proposed attacks. We also 3D-print our adversarial objects and perform physical experiments to illustrate that such vulnerability exists in the real world. Please find more visualizations and results on the anonymous website: https://sites.google.com/view/lidar-adv.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.1907.05418

Cites

6 of 6 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Adversarial attack and defense have been studied in various high-stake tasks such as face recognition [43], autonomous driving [16], and recommendation systems [47].

    “They have been studied in various high-stake tasks such as face recognition [43], autonomous driving [16], and recommendation systems [47].”

    From Trustworthy AI: From Principles to Practices (2023) · cites this paper as [16]

    The Introduction (pp. 1–2) describes the paper’s adversarial attacks on LiDAR-based autonomous driving systems, supporting the autonomous-driving example. The Conclusion (p. 8) says the findings may inform future defense methods; it does not report studying a defense. (LLM, conf=0.85)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 17

  1. [1][1] A. Athalye and I. Sutskever. Synthesizing robust adversarial examples. arXiv preprint arXiv:1707.07397 , 2017. - · arXiv
  2. [2][2] N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, 2017 , 2017. -
  3. [4][4] P. Cignoni, M. Callieri, M. Corsini, M. Dellepiane, F. Ganovelli, and G. Ranzuglia. Meshlab: an open-source mesh processing tool. In Eurographics Italian chapter conference , volume 2008, pages 129-136, 2008. -
  4. [5][5] R. Collobert and J. Weston. A unified architecture for natural language processing: Deep neural networks with multitask learning. In Proceedings of the 25th international conference on Machine learning , pages 160-167. ACM, 2008. -
  5. [7][7] I. Evtimov, K. Eykholt, E. Fernandes, T. Kohno, B. Li, A. Prakash, A. Rahmati, and D. Song. Robust physical-world attacks on deep learning models. arXiv preprint arXiv:1707.08945 , 1, 2017. - · arXiv
  6. [8][8] I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014. - · arXiv
  7. [11][11] A. Kurakin, I. Goodfellow, and S. Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 , 2016. - · arXiv
  8. [12][12] H.-T. D. Liu, M. Tao, C.-L. Li, D. Nowrouzezahrai, and A. Jacobson. Adversarial geometry and lighting using a differentiable renderer. CoRR , abs/1808.02651, 2018. - · arXiv
  9. [13][13] S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 2574-2582, 2016. -
  10. [15][15] C. R. Qi, H. Su, K. Mo, and L. J. Guibas. Pointnet: Deep learning on point sets for 3d classification and segmentation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 652-660, 2017. -
  11. [17][17] D. Silver, A. Huang, C. J. Maddison, A. Guez, L. Sifre, G. Van Den Driessche, J. Schrittwieser, I. Antonoglou, V. Panneershelvam, M. Lanctot, et al. Mastering the game of go with deep neural networks and tree search. nature , 529(7587):484, 2016. -
  12. [18][18] M. Sun, J. Tang, H. Li, B. Li, C. Xiao, Y. Chen, and D. Song. Data poisoning attack against unsupervised node embedding methods. arXiv preprint arXiv:1810.12881 , 2018. - · arXiv
  13. [19][19] C. Xiang, C. R. Qi, and B. Li. Generating 3d adversarial point clouds. arXiv preprint arXiv:1809.07016 , 2018. - · arXiv
  14. [20][20] C. Xiao, R. Deng, B. Li, F. Yu, D. Song, et al. Characterizing adversarial examples based on spatial consistency information for semantic segmentation. In Proceedings of the (ECCV) , pages 217-234, 2018. -
  15. [21][21] C. Xiao, B. Li, J.-Y. Zhu, W. He, M. Liu, and D. Song. Generating adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02610 , 2018. - · arXiv
  16. [22][22] C. Xiao, D. Yang, B. Li, J. Deng, and M. Liu. Meshadv: Adversarial meshes for visual recognition. In CVPR , 2018. -
  17. [23][23] C. Xiao, J.-Y. Zhu, B. Li, W. He, M. Liu, and D. Song. Spatially transformed adversarial examples. arXiv preprint arXiv:1801.02612 , 2018. · arXiv

Cited by

Sorted by citations

Authors
Cao, Y., Xiao, C., Yang, D., Fang, J., Yang, R., Liu, M., & Li, B.
Affiliations
  • University of Michigan (US)
  • Baidu (China) (CN)
  • University of Illinois Urbana-Champaign (US)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2019
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.1907.05418
arXiv
1907.05418
OpenAlex
W2960644152
Cited by
102
References
6
Citations by year
2025: 7 · 2024: 13 · 2023: 14 · 2022: 14 · 2021: 31 · 2020: 19 · 2019: 3 · 2018: 1
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Engineering › Automotive Engineering › Autonomous Vehicle Technology and Safety
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
Keywords
adversarial examples, LiDAR, autonomous driving, physical adversarial attacks, gradient-based attacks, Baidu Apollo, 3D printing, deep neural network vulnerabilities

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review