Optical Lens Attack on Monocular Depth Estimation for Autonomous Driving

TL;DR

LensAttack is presented, a novel physical attack that strategically places optical lenses on the camera of an autonomous vehicle to manipulate the perceived object depths, disrupting the depth estimation processes in AD systems, posing a serious threat to their reliability and safety.

Abstract

Monocular Depth Estimation (MDE) is a pivotal component of vision-based Autonomous Driving (AD) systems, enabling vehicles to estimate the depth of surrounding objects using a single camera image. This estimation guides essential driving decisions, such as braking before an obstacle or changing lanes to avoid collisions. In this paper, we explore vulnerabilities of MDE algorithms in AD systems, presenting LensAttack, a novel physical attack that strategically places optical lenses on the camera of an autonomous vehicle to manipulate the perceived object depths. LensAttack encompasses two attack formats: concave lens attack and convex lens attack, each utilizing different optical lenses to induce false depth perception. We first develop a mathematical model that outlines the parameters of the attack, followed by simulations and real-world evaluations to assess its efficacy on state-of-the-art MDE models. Additionally, we adopt an attack optimization method to further enhance the attack success rate by optimizing the attack focal length. To better evaluate the implications of LensAttack on AD, we conduct comprehensive end-to-end system simulations using the CARLA platform. The results reveal that LensAttack can significantly disrupt the depth estimation processes in AD systems, posing a serious threat to their reliability and safety. Finally, we discuss some potential defense methods to mitigate the effects of the proposed attack.

Figures (19)

• Figure 1: Ray diagrams of concave and convex lenses. (a)(b)(c) show the images formed by a convex lens, and (d) displays the images formed by a concave lens. The object is shown in red arrow and its corresponding image formed by the attack lens is shown in blue. $f$ represents the focal length.
• Figure 2: $Lens Attack$ attack scenarios. (a) illustrates the concave lens attack, and (b) showcases a convex lens attack.
• Figure 3: The pipeline of $Lens Attack$. Based on the available attack lenses and the victim camera, the adversary first calculates the expected depth after the attack based on the principle of the optical lens. Then, they define and optimize the targeted and untargeted attacks to determine the optimal focal length.
• Figure 4: Ray diagrams for (a) concave lens attack, and (b) first (c) second (d) third attack scenarios in convex lens attack. The left lens is the attack lens and the right dotted one stands for the monocular camera lens. The object is shown in red arrow and its corresponding image formed by the attack lens is shown in blue. $f$ represents the focal length of the attack lens.
• Figure 5: Experimental setup for the AV and real-world driving.