你看不见我：对LiDAR-based自动驾驶汽车驾驶框架的物理移除攻击
You Can't See Me: Physical Removal Attacks on LiDAR-based Autonomous Vehicles Driving Frameworks
摘要：
自动驾驶汽车（AV）越来越多地使用基于LiDAR的目标检测系统来感知道路上的其他车辆和行人。虽然现有的对基于LiDAR的自动驾驶架构的攻击集中在降低AV目标检测模型的置信度得分以诱导障碍物误检测，但我们的研究发现了如何利用基于激光的欺骗技术在传感器级别选择性地删除真正障碍物的LiDAR点云数据，然后将其用作AV感知的输入。这种关键的激光雷达信息的消融导致自动驾驶障碍物探测器无法识别和定位障碍物，从而导致自动驾驶汽车做出危险的自动驾驶决策。在本文中，我们提出了一种人眼不可见的方法，通过利用与自动驾驶框架集成的LiDAR传感器数据的固有自动转换和过滤过程来隐藏物体并欺骗自动驾驶车辆的障碍物检测器。我们称这种攻击为物理移除攻击（PRA），我们证明了它们对三种流行的AV障碍检测器（Apollo，Autoware，PointPillars）的有效性，我们实现了45°攻击能力。我们评估了攻击对三种融合模型（Frustum-ConvNet，AVOD和集成语义级融合）的影响，以及使用LGSVL（一种工业级模拟器）对驾驶决策的影响。在我们的移动车辆的情况下，我们实现了92.7%的成功率去除90%的目标障碍物的云点。最后，我们证明了攻击的成功对两个流行的防御欺骗和对象隐藏攻击，并讨论了两个增强的防御策略，以减轻我们的攻击。
英文摘要：
Autonomous Vehicles (AVs) increasingly use LiDAR-based object detection systems to perceive other vehicles and pedestrians on the road. While existing attacks on LiDAR-based autonomous driving architectures focus on lowering the confidence score of AV object detection models to induce obstacle misdetection, our research discovers how to leverage laser-based spoofing techniques to selectively remove the LiDAR point cloud data of genuine obstacles at the sensor level before being used as input to the AV perception. The ablation of this critical LiDAR information causes autonomous driving obstacle detectors to fail to identify and locate obstacles and, consequently, induces AVs to make dangerous automatic driving decisions. In this paper, we present a method invisible to the human eye that hides objects and deceives autonomous vehicles' obstacle detectors by exploiting inherent automatic transformation and filtering processes of LiDAR sensor data integrated with autonomous driving frameworks. We call such attacks Physical Removal Attacks (PRA), and we demonstrate their effectiveness against three popular AV obstacle detectors (Apollo, Autoware, PointPillars), and we achieve 45° attack capability. We evaluate the attack impact on three fusion models (Frustum-ConvNet, AVOD, and Integrated-Semantic Level Fusion) and the consequences on the driving decision using LGSVL, an industry-grade simulator. In our moving vehicle scenarios, we achieve a 92.7% success rate removing 90\% of a target obstacle's cloud points. Finally, we demonstrate the attack's success against two popular defenses against spoofing and object hiding attacks and discuss two enhanced defense strategies to mitigate our attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
