Research map / Adversarial robustness and security / Attacks on text and graphs
Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes 3D2Fool, a 3D texture-based physical adversarial camouflage attack that makes vehicles vanish from monocular depth estimation maps across viewpoints and weather, evaluated in CARLA and with printed scaled car models.
Problem
Physical attacks on monocular depth estimation (MDE) in autonomous driving use 2D adversarial patches that affect only small regions and fail across viewpoints and weather conditions.
Approach
Optimizes a single 2D adversarial texture seed that is tiled and randomly clipped into an object-agnostic full-surface camouflage texture (texture conversion), rendered onto 3D vehicles with a differentiable renderer, and trained under weather-like physical augmentations (exposure, shadow, rain, fog) with a vehicle-vanishing depth loss.
Key results
- On Monodepth2 in CARLA, 3D2Fool achieves Ed 12.75 and Ra 0.496 versus 6.88 / 0.265 for the best prior baseline (APARATE).
- Ablation on Monodepth2 shows the full method (TC + PA) raises Ed from 7.67 m to 12.75 m.
- In physical scaled-car experiments, Ed reaches 10.21 m outdoors and 10.67 m indoors with Ra around 0.40-0.42.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use 3D2Fool instead of APARATE | Monodepth2 · Carla simulation | Ed: 6.88 -> 12.75 | Helped |
| use 3D2Fool instead of APARATE | Depthhints · Carla simulation | Ed: 6.05 -> 10.31 | Helped |
| use 3D2Fool instead of APARATE | Manydepth · Carla simulation | Ed: 3.13 -> 6.78 | Helped |
| use 3D2Fool instead of APARATE | Robustdepth · Carla simulation | Ed: 0.95 -> 2.24 | Helped |
| add texture conversion (ablation) | 3D2Fool · Monodepth2, vehicle | Ed: 8.15 -> 12.75 | Helped |
| add physical augmentation (ablation) | 3D2Fool · Monodepth2, vehicle | Ed: 11.06 -> 12.75 | Helped |
| add texture conversion and physical augmentation (ablation) | 3D2Fool · Monodepth2, vehicle | Ed: 7.67 -> 12.75 | Helped |
| remove smoothness and NPS losses (ablation) | 3D2Fool with full modules · Monodepth2, vehicle | Ed: 12.75 -> 12.54 | No clear effect |
| add smoothness loss (ablation) | 3D2Fool with full modules · Monodepth2, vehicle | Ed: 12.54 -> 11.36 | Hurt |
| add NPS loss (ablation) | 3D2Fool with full modules · Monodepth2, vehicle | Ed: 12.54 -> 13.04 | Helped |
| add NPS loss to adversarial and smoothness losses (ablation) | 3D2Fool with full modules · Monodepth2, vehicle | Ed: 11.36 -> 12.75 | Helped |
Surprising findings
- Attacks on Monodepth2 showed higher effectiveness in foggy weather, attributed to the model's inherent weakness in fog.
Limitations
- Coverage is limited at certain viewing angles and steep surfaces, reducing attack effect.
- Evaluated only on car models with simple shapes; complex-shaped car models are future work.
- Transferability to black-box settings not explored.
Experimental setup
Datasets: CARLA simulator training images CARLA evaluation images (6124)
Benchmarks: CARLA simulation physical scaled Tesla Model Y (indoor and outdoor)
Metrics: Ed mean depth error Ra affected region ratio
Baselines: APA SPOO APARATE SAAM Random texture
Builds on: Expectation over Transformation Differentiable Transformation Attack Monodepth2 RobustDepth Non-Printability Score
Closest papers by meaning
- Beware of Road Markings: A New Adversarial Patch Attack to Monocular Depth Estimation (NeurIPS 2024 · similarity 0.91)
- DepthVanish: Optimizing Adversarial Interval Structures for Stereo-Depth-Invisible Patches (NeurIPS 2025 · similarity 0.90)
- Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · similarity 0.85)
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.85)
- Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack (AAAI 2024 · similarity 0.84)
- Fusion Is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detection (ICLR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.