Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving

By Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Wonseok Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, Z. Morley Mao. Conference on Computer and Communications Security, 2019

667 citations recorded by the source corpus.

In Autonomous Vehicles (AVs), one fundamental pillar is perception,which leverages sensors like cameras and LiDARs (Light Detection and Ranging) to understand the driving environment. Due to its direct impact on road safety, multiple prior efforts have been made to study its the security of perception systems. In contrast to prior work that concentrates on camera-based perception, in this work we perform the first security study of LiDAR-based perception in AV settings, which is highly important but unexplored. We consider LiDAR spoofing attacks as the threat model and set the attack goal as spoofing obstacles close to the front of a victim AV. We find that blindly applying LiDAR spoofing is insufficient to achieve this goal due to the machine learning-based object detection process.Thus, we then explore the possibility of strategically controlling the spoofed attack to fool the machine learning model. We formulate this task as an optimization problem and design modeling methods for the input perturbation function and the objective function.We also identify the inherent limitations of directly solving the problem using optimization and design an algorithm that combines optimization and global sampling, which improves the attack success rates to around 75%. As a case study to understand the attack impact at the AV driving decision level, we construct and evaluate two attack scenarios that may damage road safety and mobility.We also discuss defense directions at the AV system, sensor, and machine learning model levels.

Subfields: Artificial Intelligence, Molecular Biology, Signal Processing

View Paper: https://www.semanticscholar.org/paper/f1e0484607a57687da6f663954292b0c848141f1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

In Signal Processing

Citations in the corpus

Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, background): “The variants of adversarial attacks [3, 9, 12, 20, 21, 30, 32, 33, 53, 56, 63, 64, 80] cast a security threat when deploying machine learning systems.”
Physically Realizable Adversarial Examples for LiDAR Object Detection (2020, methodology): “Besides learning a physical mesh, [6] proposes to use laser devices to spoof LiDAR points.”
Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks (2021, background): “While MSF is widely recognized as a promising and general defense strategy for existing attacks on AD perception [10], [27]–[29], [38]–[43], prior works have neither studied the security of existing MSF algorithms in practical AD settings, nor made attempts to understand whether the very basic…”
Computing Systems for Autonomous Driving: State of the Art and Challenges (2020, background): “Recently, some attacks have been proposed to trick these algorithms [232].”
3D Object Detection for Autonomous Driving: A Comprehensive Survey (2022, background): “[19] attack the LiDAR sensor and spoof obstacles close to the front of a victim autonomous vehicle.”
Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasures (2020, methodology): “Besides directly spoofing fake points into LiDAR point clouds, a recent study proposes Adv-LiDAR that uses adversarial machine learning to not only spoof a set of fake points into the point cloud but also manage to deceive the LiDAR-based perception model [17].”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “[267] showed that CNN-based object detectors can be fooled in vehicle detection scenarios.”