Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adversarial 3D Virtual Patches using Integrated Gradients

Chengzeng You, Zhongyuan Hau, Binbin Xu, Soteris Demetriou

TL;DR

This work introduces VP-LiDAR, a modular framework for attacking 3D LiDAR-based detectors by concentrating perturbations into sub-regions called virtual patches (VPs). It couples manual patches (MVPs) with a data-driven, IG-based saliency approach (Saliency-LiDAR, SALL) to create critical patches (CVPs) that significantly reduce spoofing area while maintaining or increasing attack effectiveness. CVPs achieve at least 15% higher ASR than MVPs and can reduce the spoofing footprint by roughly 50% for average-sized vehicles, with strong transferability across detectors. The study demonstrates the practical risk of LiDAR spoofing under footprint constraints and provides a pathway for developing targeted defenses, including universal saliency maps and patch-based vulnerability assessments.

Abstract

LiDAR sensors are widely used in autonomous vehicles to better perceive the environment. However, prior works have shown that LiDAR signals can be spoofed to hide real objects from 3D object detectors. This study explores the feasibility of reducing the required spoofing area through a novel object-hiding strategy based on virtual patches (VPs). We first manually design VPs (MVPs) and show that VP-focused attacks can achieve similar success rates with prior work but with a fraction of the required spoofing area. Then we design a framework Saliency-LiDAR (SALL), which can identify critical regions for LiDAR objects using Integrated Gradients. VPs crafted on critical regions (CVPs) reduce object detection recall by at least 15% compared to our baseline with an approximate 50% reduction in the spoofing area for vehicles of average size.

Adversarial 3D Virtual Patches using Integrated Gradients

TL;DR

This work introduces VP-LiDAR, a modular framework for attacking 3D LiDAR-based detectors by concentrating perturbations into sub-regions called virtual patches (VPs). It couples manual patches (MVPs) with a data-driven, IG-based saliency approach (Saliency-LiDAR, SALL) to create critical patches (CVPs) that significantly reduce spoofing area while maintaining or increasing attack effectiveness. CVPs achieve at least 15% higher ASR than MVPs and can reduce the spoofing footprint by roughly 50% for average-sized vehicles, with strong transferability across detectors. The study demonstrates the practical risk of LiDAR spoofing under footprint constraints and provides a pathway for developing targeted defenses, including universal saliency maps and patch-based vulnerability assessments.

Abstract

LiDAR sensors are widely used in autonomous vehicles to better perceive the environment. However, prior works have shown that LiDAR signals can be spoofed to hide real objects from 3D object detectors. This study explores the feasibility of reducing the required spoofing area through a novel object-hiding strategy based on virtual patches (VPs). We first manually design VPs (MVPs) and show that VP-focused attacks can achieve similar success rates with prior work but with a fraction of the required spoofing area. Then we design a framework Saliency-LiDAR (SALL), which can identify critical regions for LiDAR objects using Integrated Gradients. VPs crafted on critical regions (CVPs) reduce object detection recall by at least 15% compared to our baseline with an approximate 50% reduction in the spoofing area for vehicles of average size.
Paper Structure (16 sections, 4 equations, 7 figures, 2 tables)

This paper contains 16 sections, 4 equations, 7 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. Threat Model
  4. Virtual Patches and VP-LiDAR Methodology
  5. VP-LiDAR with Manual Virtual Patches
  6. Manual Virtual Patches
  7. Experimental Setup.
  8. Results
  9. Saliency-LiDAR and Critical Virtual Patches
  10. Saliency-LiDAR Method
  11. Critical Virtual Patches
  12. Evaluation of Critical Virtual Patches
  13. Spoofing Area Analysis
  14. Effectiveness of CVPs
  15. Transferability
  16. ...and 1 more sections

Figures (7)

  • Figure 1: VP-LiDAR Visualization. Top row: manual virtual patches. Blue voxels and red points are selected while green voxels and black points are not selected. Bottom row: red points denote the shifted points while grey points remain unchanged.
  • Figure 2: ASR of MVPs for different point budgets.
  • Figure 3: Comparison of X MVP with ORA-Random.
  • Figure 4: Overview of Universal Saliency Map Generation for LiDAR Objects with SALL.
  • Figure 5: Saliency Map Visualization. Red pixels denote positive contribution values while blue pixels denote negative contribution values.
  • ...and 2 more figures