An Imperceptible Adversarial Attack Against 3-D Object Detectors in Autonomous Driving

As LiDAR-based 3-D object detection gains attention, existing research on point cloud adversarial attacks has exposed vulnerabilities in 3-D neural network models, which can further impact the reliability of perception systems in autonomous driving. However, current adversarial attacks primarily focus on the point cloud classification tasks, while detection tasks are more challenging to attack because they involve the localization of multiple targets and the sparse distribution of objects. Existing methods often implement attacks by adding global perturbations to the point clouds, which results in poor attack performance and lack of imperceptibility. In this article, we investigate the robustness of 3-D object detectors against adversarial examples. We propose a novel imperceptible attack method to generate 3-D adversarial point clouds. First, we introduce the saliency map for the point clouds, assigning the unique value to each point to measure its importance to the model’s discrimination results. These salient points are then aggregated and adaptively matched to different attack areas corresponding to different targets. Next, we design an optimization-based attack algorithm to generate adversarial point clouds, which are supervised by a dual-loss function consisting of the detection loss to ensure attack effectiveness and the distance loss to limit gap with the original point cloud. Finally, we conducted experiments on two real-world datasets, the KITTI and Waymo Open datasets, to evaluate the proposed attack method. Extensive experiments demonstrate that our attack method achieves average attack success rates of 83.07% and 77.11% on two datasets against seven 3-D object detectors with minimal perturbations. Additionally, the generated adversarial point clouds exhibit strong transferability across multiple mainstream detectors.