Exploring Adversarial Robustness of LiDAR-Camera Fusion Model in Autonomous Driving

Background of the Study

Autonomous driving (AD) technology primarily relies on accurate and reliable perception of the vehicle's surrounding environment. This perception capability is generally provided by a combination of sensors, notably cameras and LiDAR (Light Detection and Ranging). These sensors collect data that is processed by deep learning models to detect objects and make informed decisions on the road. Camera sensors offer high-resolution image data but lack depth information, whereas LiDAR sensors provide rich depth details through 360° point cloud data, despite being unordered and sparse. To overcome the limitations of individual sensors, AD systems often employ fusion models that integrate data from both LiDAR and cameras to improve object detection.

Adversarial Machine Learning in Autonomous Driving

Adversarial machine learning is a field that studies the manipulation of input data to deep learning models to produce incorrect outputs. This has become a crucial consideration in AD, where adversarial attacks can pose safety threats. Previous research has successfully demonstrated adversarial attacks that target either the camera data or LiDAR data individually. Recently, there is a growing concern over the security of fusion models that depend on both data types, as attackers could exploit either or both channels to compromise the models' object detection capabilities. Developing an effective adversarial attack involves intricate work typically subject to several physical constraints.

Attack Design and Evaluation

To explore the vulnerabilities of a LiDAR-camera fusion model specifically used in autonomous vehicles, the authors introduce an adversarial attack method designed to manipulate the LiDAR point cloud data of a target vehicle. The main goal of the attack is to hide a vehicle from detection by the AD system. The attack, aptly named the "Hiding Attack" (HA), is executed by strategically introducing a minimal number of adversarial points, which adhere to plausible physical constraints, above the target vehicle's roof.

In evaluating this approach, a classic LiDAR-camera fusion model known as MVX-Net was tested for its robustness against such adversarial attacks. Various factors influencing the effectiveness of the attack were considered, including the number of adversarial points introduced, the distance between the targeted vehicle and the LiDAR-equipped vehicle, and the angle of approach for the adversarial points.

Findings and Implications

The findings from the experiments conducted by the researchers indicate that the adversarial attack can indeed deceive the fusion model, even if only the LiDAR data is manipulated without altering the image data from cameras. A particularly disturbing revelation was that the attack's success rate increased with the number of adversarial points added. Moreover, vehicles situated farther away from the LiDAR-equipped vehicle were easier to hide, and the most effective angle of attack was directly in front of the victim vehicle.

This research contributes critical insights into the vulnerabilities of sensor fusion models in autonomous vehicles. It underscores the need for improved defensive strategies to protect against adversarially manipulated data, ultimately enhancing the safety and reliability of autonomous vehicles. The disturbing potential for real-world traffic hazards, such as rear-end collisions due to the invisibility of vehicles to the AD system, calls for urgent attention from automotive manufacturers, cybersecurity experts, and policymakers to address these security concerns proactively.