Research map / Point clouds / Segmentation and detection
A New Adversarial Perspective for LiDAR-based 3D Object Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a physical-style adversarial attack using water mist and smoke point-cloud sequences generated by a motion/content decomposition GAN (PCS-GAN), fused into real driving scans via range-image LiDAR simulation, and releases the ROLiD dataset.
Problem
LiDAR-based 3D object detectors in autonomous vehicles are vulnerable to real-world environmental interference, and existing real-world 3D attacks rely on optimized adversarial objects rather than naturally occurring random objects like water mist and smoke.
Approach
Generate water mist and smoke LiDAR point-cloud sequences with a PCS-GAN that decomposes latent space into content and motion, fuse them onto target vehicles under several fusion modes and densities, and use range-image projection to handle occlusion before testing detectors.
Key results
- Water mist attacks reach 86.34% to 95.32% attack success rate on KITTI detectors at high density (Focals Conv-F 95.32%).
- Smoke attacks achieve 93.27% success on TransFusion-L on nuScenes at low density.
- PCS-GAN achieves Chamfer distance 0.02 and Hausdorff 0.38 on water mist versus 5.81 / 1.56 for DERT.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add water mist or smoke point-cloud perturbations to the vehicle | 3D object detectors on KITTI and nuScenes · KITTI and nuScenes | attack success rate: 86.34 to 95.32 (water mist on KITTI); 81.43 to 93.27 (smoke on nuScenes) | Helped |
| Generate water mist point clouds with PCS-GAN rather than DERT | water mist point-cloud generation · water mist point-cloud generation | Hausdorff distance: 5.81 -> 0.38 | Helped |
| Generate water mist point clouds with PCS-GAN rather than DERT | water mist point-cloud generation · water mist point-cloud generation | Chamfer distance: 1.56 -> 0.02 | Helped |
| Train PV-RCNN with clean and water mist-augmented point clouds, then test on clean data | PV-RCNN · KITTI clean point clouds | Car AP@0.70, 0.70, 0.70: 98.72 -> 98.98; 90.02 -> 89.99; 89.70 -> 89.68 | Mixed |
| Use two sides fusion instead of body side, head/tail side, or corner point fusion (ablation) | TED on KITTI with water mist · KITTI, TED, water mist | attack success rate: 61.01, 55.30, 57.22 -> 86.98 | Helped |
| Increase horizontal density d_h from 0.1 to 0.5 (ablation) | TED on KITTI with water mist and two sides fusion · KITTI, TED, water mist | attack success rate: 75.73 -> 86.98 | Helped |
| Increase vertical density d_v from 0.001 to 0.004 (ablation) | TED on KITTI with water mist and two sides fusion · KITTI, TED, water mist | attack success rate: 73.24 -> 86.98 | Helped |
| Increase horizontal density d_h from 0.01 to 0.10 at d_v=0.001 (ablation) | PV-RCNN on KITTI with water mist and body side fusion · KITTI, PV-RCNN, low-density water mist | attack success rate: 13.38 -> 33.94 | Helped |
| Increase horizontal density d_h at fixed vertical density d_v (ablation) | PV-RCNN on KITTI with water mist and body side fusion · KITTI, PV-RCNN, low-density water mist | attack success rate: 33.94 -> 55.93 | Helped |
| Rotate water mist beyond 10° from the reference angle (ablation) | 3D detectors under water mist perturbation · KITTI and nuScenes, water mist spray angles | attack success rate | Hurt |
Surprising findings
- Attack success is maintained within about 10 degrees of spray rotation and decreases beyond that.
- Training detectors with water mist-augmented point clouds yields only a slight accuracy change for PV-RCNN, per the paper.
Limitations
- Attack effectiveness depends on density parameters and fusion mode chosen by the attacker, which are tuned per dataset.
- Range-image projection loses over 10^4 points per KITTI frame and needs a correction model for missing horizontal lines.
- Evaluation uses simulated fusion onto public dataset frames rather than a physical real-world attack.
Experimental setup
Datasets: KITTI nuScenes ROLiD
Benchmarks: KITTI nuScenes
Metrics: attack success rate Hausdorff distance Chamfer distance AP
Baselines: TED Focals Conv-F Part-A2-Anchor Part-A2-Free PV-RCNN PointPillar VoxelNeXt TransFusion-L CenterPoint DERT
Builds on: MoCoGAN PointNet TPU-GAN WGAN
Closest papers by meaning
- Physically Realizable Adversarial Examples for LiDAR Object Detection (CVPR 2020 · similarity 0.91)
- OBJVanish: Prompt-Driven Generation of Physically Realizable 3D LiDAR-Invisible Objects (ICML 2026 · similarity 0.90)
- SlowLiDAR: Increasing the Latency of LiDAR-Based Detection Using Adversarial Examples (CVPR 2023 · similarity 0.89)
- LaserNet: An Efficient Probabilistic 3D Object Detector for Autonomous Driving (CVPR 2019 · similarity 0.88)
- An Empirical Study of the Generalization Ability of Lidar 3D Object Detectors to Unseen Domains (CVPR 2024 · similarity 0.87)
- Pre-training LiDAR-based 3D Object Detectors through Colorization (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.