Adv3D: Generating 3D Adversarial Examples for 3D Object Detection in Driving Scenarios with NeRF
Artificial Intelligence Thrust, The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州）人工智能学科）；Department of Computer Science and Engineering, The Hong Kong University of Science and Technology（香港科技大学计算机科学与工程学系）
本文提出 Adv3D，首次将对抗样本建模为 NeRF，并通过基元感知采样与语义引导正则化生成可物理实现的 3D 伪装纹理补丁，攻击驾驶场景中的 3D 检测器。
摘要：
深度神经网络（DNN）已被证明极易受到对抗样本的影响，这给基于 DNN 的自动驾驶技术栈（即 3D 目标检测）带来了特殊的安全攸关问题。尽管已有大量关于图像级攻击的研究，但它们大多局限于二维像素空间，而且这类攻击在我们的三维世界中并不总是具有物理现实性。为此，我们提出 Adv3D，这是首次探索将对抗样本建模为神经辐射场（NeRF）。NeRF 的进展可提供照片级真实外观和三维精确生成，从而产生更真实、更可实现的对抗样本。我们通过在训练集上最小化 3D 检测器预测的周围目标置信度来训练对抗性 NeRF。随后，我们在未见过的验证集上评估 Adv3D，结果表明，在任意采样姿态渲染 NeRF 时，它都能造成大幅性能下降。为生成物理上可实现的对抗样本，我们提出基元感知采样和语义引导正则化，使带有伪装对抗纹理的 3D 补丁攻击成为可能。实验结果表明，训练得到的对抗性 NeRF 能很好地泛化到不同姿态、场景和 3D 检测器。最后，我们针对该攻击提供了一种防御方法，即通过数据增强进行对抗训练。项目页面：https://len-li.github.io/adv3d-web
英文摘要：
Deep neural networks (DNNs) have been proven extremely susceptible to adversarial examples, which raises special safety-critical concerns for DNN-based autonomous driving stacks (i.e., 3D object detection). Although there are extensive works on image-level attacks, most are restricted to 2D pixel spaces, and such attacks are not always physically realistic in our 3D world. Here we present Adv3D, the first exploration of modeling adversarial examples as Neural Radiance Fields (NeRFs). Advances in NeRF provide photorealistic appearances and 3D accurate generation, yielding a more realistic and realizable adversarial example. We train our adversarial NeRF by minimizing the surrounding objects' confidence predicted by 3D detectors on the training set. Then we evaluate Adv3D on the unseen validation set and show that it can cause a large performance reduction when rendering NeRF in any sampled pose. To generate physically realizable adversarial examples, we propose primitive-aware sampling and semantic-guided regularization that enable 3D patch attacks with camouflage adversarial texture. Experimental results demonstrate that the trained adversarial NeRF generalizes well to different poses, scenes, and 3D detectors. Finally, we provide a defense method to our attacks that involves adversarial training through data augmentation. Project page: https://len-li.github.io/adv3d-web
Deep learning and convolutional neural networks allow achieving impressive performance in computer vision tasks, such as object detection and semantic segmentation (SS). However, recent studies have shown evident weaknesses of such models against adversarial perturbations. In a real-world scenario instead, like autonomous driving, more attention should be devoted to real-world adversarial examples (RWAEs), which are physical objects (e.g., billboards and printable patches) optimized to be adversarial to the entire perception pipeline. This paper presents an in-depth evaluation of the robustnes…
UC-NeRF: Neural Radiance Field for Under-Calibrated Multi-view Cameras in Autonomous Driving
University of Science and Technology of China（中国科学技术大学）；PKU-Wuhan Institute for Artificial Intelligence（北大武汉人工智能研究院）；DJI Technology（大疆科技）；ShanghaiTech University（上海科技大学）
Neural Radiance Field in Autonomous Driving: A Survey
School of Vehicle and Mobility, Tsinghua University（清华大学车辆与学院）；AI Thrust, Information Hub, The Hong Kong University of Science and Technology - Guangzhou Campus（香港科技大学广州校区信息枢纽AI中心）；School of Engineering Mathematics and Technology, University of Bristol（布里斯托大学工程数学与技术学院）
Neural Radiance Fields (NeRFs) aim to synthesize novel views of objects and scenes, given the object-centric camera views with large overlaps. However, we conjugate that this paradigm does not fit the nature of the street views that are collected by many self-driving cars from the large-scale unbounded scenes. Also, the onboard cameras perceive scenes without much overlapping. Thus, existing NeRFs often produce blurs, 'floaters' and other artifacts on street-view synthesis. In this paper, we propose a new street-view NeRF (S-NeRF) that considers novel view synthesis of both the large-scale bac…
FreeDriveRF: Monocular RGB Dynamic NeRF without Poses for Autonomous Driving via Point-Level Dynamic-Static Decoupling
Department of Automation, Key Laboratory of System Control and Information Processing of Ministry of Education, Key Laboratory of Marine Intelligent Equipment and System of Ministry of Education, Shanghai Engineering Research Center of Intelligent Control and Management（自动化系、教育部长系统控制与信息处理重点实验室、教育部长海洋智能设备与系统重点实验室、上海智能控制与管理工程研究中心）；Dimanshen Technology Co., Ltd.（迪马森科技有限公司）；Engineering Research Center of Intelligent Control for Underground Space, Ministry of Education, School of Information and Control Engineering, Advanced Robotics Research Center, China University of Mining and Technology（地下空间智能控制工程研究中心、教育部长、信息与控制工程学院、先进机器人研究中心、中国矿业大学）
Uber ATG（优步先进技术集团）；University of Toronto（多伦多大学）；Princeton University（普林斯顿大学）
Modern autonomous driving systems rely heavily on deep learning models to process point cloud sensory data; meanwhile, deep models have been shown to be susceptible to adversarial attacks with visually imperceptible perturbations. Despite the fact that this poses a security concern for the self-driving industry, there has been very little exploration in terms of 3D perception, as most adversarial attacks have only been applied to 2D flat images. In this paper, we address this issue and present a method to generate universal 3D adversarial objects to fool LiDAR detectors. In particular, we demo…
Segment-Anything Models Achieve Zero-shot Robustness in Autonomous Driving
College of Electronics and Information Engineering, Tongji University（同济大学电子与信息工程学院）；Graz University of Technology（格拉茨工业大学）；Virtual Vehicle Research（虚拟车辆研究院）
Simon Fraser University（西蒙弗雷泽大学）；Amii（阿尔伯塔机器智能研究所）
We explore the task of text to 3D object generation using CLIP. Specifically, we use CLIP for guidance without access to any datasets, a setting we refer to as pure CLIP guidance. While prior work has adopted this setting, there is no systematic study of mechanics for preventing adversarial generations within CLIP. We illustrate how different image-based augmentations prevent the adversarial generation problem, and how the generated results are impacted. We test different CLIP model architectures and show that ensembling different models for guidance can prevent adversarial generations within …
MARS: An Instance-aware, Modular and Realistic Simulator for Autonomous Driving
AIR, Tsinghua University（清华大学AIR）；System Thurst, HKUST(GZ)（香港科技大学（广州）System Thurst）；HKUST（香港科技大学）；McGill University（麦吉尔大学）；Beijing Institute of Technology（北京理工大学）；National University of Singapore（新加坡国立大学）；HKU（香港大学）；University of Wisconsin Madison（威斯康星大学麦迪逊分校）；Xi’an University of Architecture and Technology（西安建筑科技大学）；Imperial College London（伦敦帝国学院）；Zhejiang University（浙江大学）
Shanghai AI Laboratory（上海人工智能实验室）；SenseTime Research（商汤科技研究院）
Driving scenes are extremely diverse and complicated that it is impossible to collect all cases with human effort alone. While data augmentation is an effective technique to enrich the training data, existing methods for camera data in autonomous driving applications are confined to the 2D image plane, which may not optimally increase data diversity in 3D real-world scenarios. To this end, we propose a 3D data augmentation approach termed Drive-3DAug, aiming at augmenting the driving scenes on camera in the 3D space. We first utilize Neural Radiance Field (NeRF) to reconstruct the 3D models of…
Representing and synthesizing novel views in real-world dynamic scenes from casual monocular videos is a long-standing problem. Existing solutions typically approach dynamic scenes by applying geometry techniques or utilizing temporal information between several adjacent frames without considering the underlying background distribution in the entire scene or the transmittance over the ray dimension, limiting their performance on static and occlusion areas. Our approach $\textbf{D}$istribution-$\textbf{D}$riven neural radiance fields offers high-quality view synthesis and a 3D solution to $\tex…
The University of Sydney（悉尼大学）；Massachusetts Institute of Technology（麻省理工学院）；Institute for AI Industry Research, Tsinghua University（清华大学人工智能产业研究院）；Beijing Institute of Technology（北京理工大学）；The University of New South Wales（新南威尔士大学）
3D reconstruction from images has wide applications in Virtual Reality and Automatic Driving, where the precision requirement is very high. Ground-breaking research in the neural radiance field (NeRF) by utilizing Multi-Layer Perceptions has dramatically improved the representation quality of 3D objects. Some later studies improved NeRF by building truncated signed distance fields (TSDFs) but still suffer from the problem of blurred surfaces in 3D reconstruction. In this work, this surface ambiguity is addressed by proposing a novel way of 3D shape representation, OmniNeRF. It is based on trai…
In advanced mission concepts with high levels of autonomy, spacecraft need to internally model the pose and shape of nearby orbiting objects. Recent works in neural scene representations show promising results for inferring generic three-dimensional scenes from optical images. Neural Radiance Fields (NeRF) have shown success in rendering highly specular surfaces using a large number of images and their pose. More recently, Generative Radiance Fields (GRAF) achieved full volumetric reconstruction of a scene from unposed images only, thanks to the use of an adversarial framework to train a NeRF.…
Visual detection is a key task in autonomous driving, and it serves as a crucial foundation for self-driving planning and control. Deep neural networks have achieved promising results in various visual tasks, but they are known to be vulnerable to adversarial attacks. A comprehensive understanding of deep visual detectors' vulnerability is required before people can improve their robustness. However, only a few adversarial attack/defense works have focused on object detection, and most of them employed only classification and/or localization losses, ignoring the objectness aspect. In this pape…
S^3D-NeRF: Single-Shot Speech-Driven Neural Radiance Field for High Fidelity Talking Head Synthesis
School of Artificial Intelligence, University of Chinese Academy of Sciences（中国科学院大学人工智能学院）；Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所）；Alibaba Group（阿里巴巴集团）
Although Deep neural networks (DNNs) are being pervasively used in vision-based autonomous driving systems, they are found vulnerable to adversarial attacks where small-magnitude perturbations into the inputs during test time cause dramatic changes to the outputs. While most of the recent attack methods target at digital-world adversarial scenarios, it is unclear how they perform in the physical world, and more importantly, the generated perturbations under such methods would cover a whole driving scene including those fixed background imagery such as the sky, making them inapplicable to physi…
The University of Texas at Dallas（得克萨斯大学达拉斯分校）；Southern University of Science and Technology（南方科技大学）；The Chinese University of Hong Kong（香港中文大学）
Deep Neural Networks (DNNs) have been widely applied in many autonomous systems such as autonomous driving. Recently, DNN testing has been intensively studied to automatically generate adversarial examples, which inject small-magnitude perturbations into inputs to test DNNs under extreme situations. While existing testing techniques prove to be effective, they mostly focus on generating digital adversarial perturbations (particularly for autonomous driving), e.g., changing image pixels, which may never happen in physical world. There is a critical missing piece in the literature on autonomous …
Valeo R&D Egypt（法雷奥研发埃及）；Valeo DAR Germany（法雷奥DAR德国）；Technische Universität Ilmenau（伊尔梅瑙工业大学）；Valeo Ireland（法雷奥爱尔兰）
Deep neural networks (DNNs) have accomplished impressive success in various applications, including autonomous driving perception tasks, in recent years. On the other hand, current deep neural networks are easily fooled by adversarial attacks. This vulnerability raises significant concerns, particularly in safety-critical applications. As a result, research into attacking and defending DNNs has gained much coverage. In this work, detailed adversarial attacks are applied on a diverse multi-task visual perception deep network across distance estimation, semantic segmentation, motion detection, a…
University of Texas at Dallas（德克萨斯大学达拉斯分校）；Honda Research Institute（本田研究所）
Anomaly driving detection is an important problem in advanced driver assistance systems (ADAS). It is important to identify potential hazard scenarios as early as possible to avoid potential accidents. This study proposes an unsupervised method to quantify driving anomalies using a conditional generative adversarial network (GAN). The approach predicts upcoming driving scenarios by conditioning the models on the previously observed signals. The system uses the difference of the output from the discriminator between the predicted and actual signals as a metric to quantify the anomaly degree of …
Technische Universität Braunschweig（布伦瑞克工业大学）；Volkswagen Group Automation（大众汽车集团自动驾驶部门）
Enabling autonomous driving (AD) can be considered one of the biggest challenges in today's technology. AD is a complex task accomplished by several functionalities, with environment perception being one of its core functions. Environment perception is usually performed by combining the semantic information captured by several sensors, i.e., lidar or camera. The semantic information from the respective sensor can be extracted by using convolutional neural networks (CNNs) for dense prediction. In the past, CNNs constantly showed state-of-the-art performance on several vision-related tasks, such…
