Research map / Adversarial robustness and security / Attacks on text and graphs
Enduring, Efficient and Robust Trajectory Prediction Attack in Autonomous Driving via Optimization-Driven Multi-Frame Perturbation Framework
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes OMP-Attack, a LiDAR-induced indirect trajectory prediction attack that places cardboard objects via PSO-based location search over multi-frame state perturbations, evaluated on nuScenes.
Problem
Indirect (LiDAR-induced) trajectory prediction attacks in autonomous driving are transient, easily filtered, and sensitive to attack point and adversarial object properties.
Approach
Extends single-point attacks across multiple consecutive historical frames, optimizes adversarial object locations with three losses (pose, heading, DTW shape) via particle swarm optimization, and treats objects as center points during search ("Precise Attack, Vague Optimization") for robustness.
Key results
- OMP-Attack reduces ATD by 47% versus SP-Attack (6.439 vs 7.212 m under the default setting), doubles PRE (2.393 vs 1.191 m), and raises collision rate from 42% to 64%.
- Over 4 preceding frames, OMP-Attack averages ATD 6.551 m, PRE 2.938 m, CR 53%, versus SP-Attack's 9.877 m, 1.86 m, 26%.
- In black-box transfer to AgentFormer, OMP-Attack reduces ATD by 3.386 m and increases PRE by 1.705 m, outperforming SP-Attack.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace Brute-Force search with OMP-Attack | LiDAR-induced trajectory prediction attack · nuScenes | ATD (m): 8.196 -> 6.439 | Helped |
| replace SP-Attack with OMP-Attack | LiDAR-induced trajectory prediction attack · nuScenes | PRE (m): 1.191 -> 2.393 | Helped |
| use OMP-Attack locations against Agentformer | Agentformer · nuScenes, black-box | PRE (m): 0 -> 1.705 | Helped |
| add PSO location search (ablation) | SP-Attack · nuScenes | ATD (m): 7.212 -> 8.099 | Hurt |
| add PSO location optimization (ablation) | OMP-Attack · nuScenes | PRE (m): 0.813 -> 2.393 | Helped |
| increase PSO particles from 10 to 20 (ablation) | OMP-Attack · nuScenes | PRE (m): 2.393 -> 3.183 | Helped |
| increase PSO particles from 10 to 15 (ablation) | OMP-Attack · nuScenes | CR: 64% -> 44% | Hurt |
| use object orientations of 45°, 90°, or 135° instead of 0° (ablation) | OMP-Attack · nuScenes | ATD (m): 6.439 -> 6.821; 5.591; 7.252 | Mixed |
| vary cardboard diameter from 0.1 to 0.5 meters (ablation) | OMP-Attack · nuScenes | ATD (m): 6.386 meters fluctuation range | No clear effect |
| offset the victim AV from the attack point by up to 1 meter (ablation) | OMP-Attack · nuScenes | ATD (m): maximum ATD error is only 1.037 meters | Hurt |
| offset the victim AV from the attack point by 0.1 meter (ablation) | SP-Attack · nuScenes | ATD (m): ATD increases by 3 meters | Hurt |
| extend the attack to multiple consecutive historical frames | OMP-Attack · nuScenes, endurance frames t-3 to t | ATD (m): 9.877 -> 6.551 | Helped |
Surprising findings
- Brute-Force search fails to pose a threat in the black-box setting (PRE 0.610 m, CR 14%)
- Larger cardboard diameters are not uniformly worse; attack performance improves as diameter grows since more perturbed points come from the object surface
Limitations
- Evaluated on only 50 manually selected nuScenes scenes
- Attack success degrades in black-box transfer (CR 26%)
- Relies on a specific LiDAR detection and tracking stack (SP-Attack setup)
Experimental setup
Datasets: nuScenes
Benchmarks: nuScenes
Metrics: average trajectory distance (ATD) planning-response error (PRE) collision rate (CR)
Baselines: SP-Attack Brute-Force search
Builds on: SP-Attack projected gradient descent particle swarm optimization dynamic time warping
Closest papers by meaning
- Adversarial Backdoor Attack by Naturalistic Data Poisoning on Trajectory Prediction in Autonomous Driving (CVPR 2024 · similarity 0.88)
- Certified Human Trajectory Prediction (CVPR 2025 · similarity 0.85)
- A New Adversarial Perspective for LiDAR-based 3D Object Detection (AAAI 2025 · similarity 0.85)
- SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples (AAAI 2024 · similarity 0.84)
- World Models as Adversaries: Multi-Agent Self-Play Fine-Tuning for Robust Motion Planning (NeurIPS 2026 · similarity 0.84)
- Neural Reconstruction of LiDAR Point Clouds under Jamming Attacks via Full-Waveform Representation and Simultaneous Laser Sensing (NeurIPS 2026 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.