Adversarial Attacks on LiDAR-Based Tracking Across Road Users: Robustness Evaluation and Target-Aware Black-Box Method

TL;DR

This work studies the robustness of neural LiDAR-based 3D trackers to adversarial perturbations and introduces a unified attack framework covering white-box and black-box regimes. It presents a Target-aware Perturbation Generation (TAPG) approach for transfer-based black-box attacks that enforces sparse perturbations and employs random sub-vector factorization to enhance transferability while keeping perturbations perceptually concealed. Through evaluations on KITTI and nuScenes across four trackers, the study reveals substantial vulnerability of current tracking methods to adversarial attacks, with TAPG delivering strong transfer performance and favorable imperceptibility compared to baselines. The results underscore the need for robustness-aware design in LiDAR-based tracking for safety-critical applications and provide a benchmark for future defense development.

Abstract

In this study, we delve into the robustness of neural network-based LiDAR point cloud tracking models under adversarial attacks, a critical aspect often overlooked in favor of performance enhancement. These models, despite incorporating advanced architectures like Transformer or Bird's Eye View (BEV), tend to neglect robustness in the face of challenges such as adversarial attacks, domain shifts, or data corruption. We instead focus on the robustness of the tracking models under the threat of adversarial attacks. We begin by establishing a unified framework for conducting adversarial attacks within the context of 3D object tracking, which allows us to thoroughly investigate both white-box and black-box attack strategies. For white-box attacks, we tailor specific loss functions to accommodate various tracking paradigms and extend existing methods such as FGSM, C\&W, and PGD to the point cloud domain. In addressing black-box attack scenarios, we introduce a novel transfer-based approach, the Target-aware Perturbation Generation (TAPG) algorithm, with the dual objectives of achieving high attack performance and maintaining low perceptibility. This method employs a heuristic strategy to enforce sparse attack constraints and utilizes random sub-vector factorization to bolster transferability. Our experimental findings reveal a significant vulnerability in advanced tracking methods when subjected to both black-box and white-box attacks, underscoring the necessity for incorporating robustness against adversarial attacks into the design of LiDAR point cloud tracking models. Notably, compared to existing methods, the TAPG also strikes an optimal balance between the effectiveness of the attack and the concealment of the perturbations.

Figures (10)

• Figure 1: The goals of the adversarial attack. (a) demonstrates the motivation of this work, i.e., the samples generated by the adversarial attack need to make the original model lose its target and maintain its own imperceptibility. (b) gives the results of the proposed TAPG compared to the other attack methods in terms of the attack success rate (ASR) and Chamfer distance (CD). The closer the method is to the top-left corner, the more superior it is.
• Figure 2: Different tracking paradigms for 3D LiDAR point clouds. From left to right, there are vote-based two-stream paradigm, BEV-based two-stream paradigm, and motion-based one-stream paradigm.
• Figure 3: The pipeline of the proposed black-box attack method.
• Figure 4: Plots of the attack success rate (ASR) and attack precision rate (APR). The cumulative areas of ASR and APR are shown here. The larger the area, the better the results.
• Figure 5: Hausdorff distance between origin and contaminated samples. Each 3D tracker (marked with different colors) is evaluated by six attack approaches. The first row shows the results for cars, and the second row shows the results for pedestrians.