A First Physical-World Trajectory Prediction Attack via LiDAR-induced Deceptions in Autonomous Driving

TL;DR

This paper reveals a novel physical-world threat to autonomous driving by showing that LiDAR-based perception perturbations can indirectly induce erroneous trajectory predictions. It introduces a two-stage inverse attack that first crafts velocity-insensitive perturbations to the prediction input and then identifies feasible object placements via a Hungarian-based location matching, guided by distributional patterns in perception outputs and using EoT and PGD. The approach achieves up to 63% collision rate on a public dataset and demonstrates successful real-world demonstrations, with robustness to object displacement and velocity variations, and cross-model transferability. The work also discusses lightweight defenses, including a heading-based detector and other strategies such as PercepGuard, adversarial training, and MC-dropout, highlighting practical implications for improving AV safety and motivating further research into pipeline-wide defenses.

Abstract

Trajectory prediction forecasts nearby agents' moves based on their historical trajectories. Accurate trajectory prediction is crucial for autonomous vehicles. Existing attacks compromise the prediction model of a victim AV by directly manipulating the historical trajectory of an attacker AV, which has limited real-world applicability. This paper, for the first time, explores an indirect attack approach that induces prediction errors via attacks against the perception module of a victim AV. Although it has been shown that physically realizable attacks against LiDAR-based perception are possible by placing a few objects at strategic locations, it is still an open challenge to find an object location from the vast search space in order to launch effective attacks against prediction under varying victim AV velocities. Through analysis, we observe that a prediction model is prone to an attack focusing on a single point in the scene. Consequently, we propose a novel two-stage attack framework to realize the single-point attack. The first stage of prediction-side attack efficiently identifies, guided by the distribution of detection results under object-based attacks against perception, the state perturbations for the prediction model that are effective and velocity-insensitive. In the second stage of location matching, we match the feasible object locations with the found state perturbations. Our evaluation using a public autonomous driving dataset shows that our attack causes a collision rate of up to 63% and various hazardous responses of the victim AV. The effectiveness of our attack is also demonstrated on a real testbed car. To the best of our knowledge, this study is the first security analysis spanning from LiDAR-based perception to prediction in autonomous driving, leading to a realistic attack on prediction. To counteract the proposed attack, potential defenses are discussed.

Figures (22)

• Figure 1: A motivation experiment.
• Figure 2: Our attack scenario. Solid blue arrows are victim AV's planned trajectories; dash red arrow is adversarial vehicle's future trajectory predicted by the victim AV.
• Figure 3: Our proposed inverse attack framework for identifying the adversarial locations to place objects (cardboards in red boxes). The framework operates within the AD system pipeline, which is outlined on the left for reference.
• Figure 4: Histogram of coordinates and heading perturbations in nuScenes dataset scenes and a self-collected real-world scene under object-based attacks.
• Figure 5: Average Trajectory Distance (ATD), Planning-Response Error (PRE), and Collision Rate (CR) under clean, brute-force sampling attack, and our inverse attack scenarios.