TwinIR：针对在线高清地图构建的协同式不可见双点攻击
TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Construction
- City University of Hong Kong（香港城市大学）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
针对在线HD地图构建的跨边界补偿效应，提出TwinIR攻击方法，通过优化攻击点实现低感知性的有效攻击，可显著降低地图构建精度并影响自动驾驶决策。
AI中文摘要：
在线高清（HD）地图构建对自动驾驶的预测与规划至关重要。我们发现，现有针对在线地图构建的物理攻击受跨边界补偿效应限制：在目标边界被扰动后，另一可见边界可能保留足够的几何线索，使模型恢复原始道路几何结构。基于此观察，我们提出TwinIR，一种新的、机制引导的在线地图构建物理攻击方法。TwinIR联合优化攻击有效性与点稀疏度，力求用最少的攻击点抑制周围边界的补偿性几何线索。为降低多点攻击的可感知性，TwinIR建模相机对近红外光照的响应，并将优化后的攻击点映射到可行的物理放置位置，产生仅在可见光谱变化极小的情况下对相机的干扰。在nuScenes数据集上针对当前最先进的在线地图构建模型开展的实验表明，TwinIR在RSA条件下将mAP降低8.18-8.96个百分点，在ETA条件下降低2.84-5.62个百分点；相较于干净输入，还将不可达目标率提高25-28个百分点，不安全规划轨迹率提高19-20个百分点。这些攻击也在真实测试平台自动驾驶车辆（AV）上得到验证，TwinIR成功诱导道路直线化和提前转向变形，同时在全彩色视图中保持不显眼。
英文摘要：
Online HD map construction is critical to prediction and planning in autonomous driving. We find that existing physical attacks against online map construction are limited by a cross-boundary compensation effect: after the target boundary is perturbed, another visible boundary may retain sufficient geometric cues for the model to recover the original road geometry. Based on this observation, we propose TwinIR, a new mechanism-guided physical attack methodology for online map construction. TwinIR jointly optimizes attack effectiveness and point sparsity, seeking the minimum number of attack points needed to suppress compensating geometric cues from surrounding boundaries. To reduce the perceptibility of multi-point attacks, TwinIR models camera responses to near-infrared illumination and maps optimized attack points to feasible physical placements, producing camera-visible interference with minimal visible-spectrum changes. Experiments on nuScenes across state-of-the-art online map construction models show that TwinIR reduces mAP by 8.18-8.96 percentage points under RSA and 2.84-5.62 points under ETA, while increasing the unreachable-goal rate by 25-28 points and the unsafe-planned-trajectory rate by 19-20 points over clean inputs. These attacks are also validated on a real-world testbed AV, where TwinIR successfully induces both road straightening and early-turn deformations while remaining inconspicuous in full-color views.
