不可见的触发器，可见的威胁！面向自动驾驶视觉3D检测的路式对抗生成攻击
Invisible Triggers, Visible Threats! Road-Style Adversarial Creation Attack for Visual 3D Detection in Autonomous Driving
AI总结：
本文提出AdvRoad，通过生成自然道路风格的对抗性贴纸，提升自动驾驶系统在视觉3D检测中的鲁棒性，实验表明其在不同检测器和场景中均有效。
摘要：
现代自动驾驶（AD）系统利用3D目标检测来感知三维环境中的前景对象，以进行后续预测和规划。基于RGB相机的视觉3D检测相比LiDAR方法更具成本效益。尽管取得了有希望的检测精度，当前基于深度神经网络的模型仍然高度易受对抗示例攻击。安全担忧促使我们研究自动驾驶场景中的现实对抗攻击。先前工作展示了在道路表面放置对抗性海报以诱导检测器幻觉的可行性。然而，这些海报的不自然外观容易被人类察觉，且固定内容容易被防御。为了解决这些限制，我们提出AdvRoad以生成多样化的道路风格对抗性海报。对手具有自然外观，与道路表面相似，同时使检测器感知到不存在的对象。我们采用两阶段方法，即道路风格对抗生成和场景关联适应，以在输入场景中最大化攻击效果，同时确保海报的自然外观，使攻击能够隐秘进行而不引起人类注意。大量实验表明，AdvRoad在不同检测器、场景和伪装位置上均表现良好。此外，物理攻击进一步证明了现实世界中的实际威胁。
英文摘要：
Modern autonomous driving (AD) systems leverage 3D object detection to perceive foreground objects in 3D environments for subsequent prediction and planning. Visual 3D detection based on RGB cameras provides a cost-effective solution compared to the LiDAR paradigm. While achieving promising detection accuracy, current deep neural network-based models remain highly susceptible to adversarial examples. The underlying safety concerns motivate us to investigate realistic adversarial attacks in AD scenarios. Previous work has demonstrated the feasibility of placing adversarial posters on the road surface to induce hallucinations in the detector. However, the unnatural appearance of the posters makes them easily noticeable by humans, and their fixed content can be readily targeted and defended. To address these limitations, we propose the AdvRoad to generate diverse road-style adversarial posters. The adversaries have naturalistic appearances resembling the road surface while compromising the detector to perceive non-existent objects at the attack locations. We employ a two-stage approach, termed Road-Style Adversary Generation and Scenario-Associated Adaptation, to maximize the attack effectiveness on the input scene while ensuring the natural appearance of the poster, allowing the attack to be carried out stealthily without drawing human attention. Extensive experiments show that AdvRoad generalizes well to different detectors, scenes, and spoofing locations. Moreover, physical attacks further demonstrate the practical threats in real-world environments.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
