LiDAttack: Robust Black-box Attack on LiDAR-based Object Detection

TL;DR

LiDAttack is introduced as a robust black-box attack that leverages genetic algorithms with simulated annealing to precisely control perturbation points, ensuring both stealth and efficacy.

Abstract

Since DNN is vulnerable to carefully crafted adversarial examples, adversarial attack on LiDAR sensors have been extensively studied. We introduce a robust black-box attack dubbed LiDAttack. It utilizes a genetic algorithm with a simulated annealing strategy to strictly limit the location and number of perturbation points, achieving a stealthy and effective attack. And it simulates scanning deviations, allowing it to adapt to dynamic changes in real world scenario variations. Extensive experiments are conducted on 3 datasets (i.e., KITTI, nuScenes, and self-constructed data) with 3 dominant object detection models (i.e., PointRCNN, PointPillar, and PV-RCNN++). The results reveal the efficiency of the LiDAttack when targeting a wide range of object detection models, with an attack success rate (ASR) up to 90%.

Figures (14)

• Figure 1: Normal detection and adversarial scenarios. The left column indicates that the target object can be detected normally, and the right column indicates that the target object cannot be detected or misdetected by adding adversarial objects.
• Figure 2: The overall framework of LiDAttack.
• Figure 3: Encoding process in LiDAttack.
• Figure 4: Crossover process in LiDAttack.
• Figure 5: Mutation process in LiDAttack.