Research map / Adversarial robustness and security / Attacks on text and graphs
COMMIT: Certifying Robustness of Multi-Sensor Fusion Systems Against Semantic Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes COMMIT, the first certified-robustness framework for camera-LiDAR multi-sensor fusion 3D detectors against semantic rotation and shifting transformations, using anisotropic randomized smoothing with grid-based splitting and IoU lower bounds, evaluated on a CARLA-based benchmark.
Problem
Multi-sensor fusion perception in autonomous vehicles is vulnerable to semantic transformations (rotation, shifting) of objects, and no certified defense existed for such fusion systems, nor for IoU-based 3D box criteria.
Approach
Applies randomized smoothing with anisotropic Gaussian noise on image and point cloud inputs, splits the transformation parameter space into a grid so small-l_p certificates combine into certificates for semantic transformations, and derives detection-confidence and 3D IoU lower bounds for median-smoothed fusion detectors.
Key results
- Under rotation transformations, CLOCs achieves 53.23% certified AP@50 at |r|<=30 degrees, and the certified detection rate reaches 100% for FocalsConv and MonoCon-level comparisons at small radii.
- Certified multi-sensor fusion results exceed single-modal models by up to 48.39% (abstract claim), e.g., CLOCs retains 48.39% certified AP@50 under shifting 10-13 m.
- Certified lower bounds are close to empirical PGD-smoothed results in most cases, indicating tight certification.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use camera-LiDAR fusion rather than a single-modal detector | CARLA rotation certification · CARLA rotation | AP@50 | Mixed |
| Use camera-LiDAR fusion rather than a single-modal detector | CARLA rotation certification · CARLA rotation | Det@80 | Mixed |
| Use camera-LiDAR fusion rather than a single-modal detector | CARLA shifting certification · CARLA shifting | Det@80 | Mixed |
| Smooth the model with Gaussian augmentation and median smoothing | CLOCs · CARLA rotation |r|≤30° | Det@80: 3.23% -> 50.00% | Helped |
| Smooth the model with Gaussian augmentation and median smoothing | CLOCs · CARLA rotation |r|≤30° | AP@50: 80.65% -> 98.39% | Helped |
| Smooth the model with Gaussian augmentation and median smoothing | MonoCon · CARLA rotation |r|≤30° | Det@80: 32.26% -> 80.65% | Helped |
| Smooth the model with Gaussian augmentation and median smoothing | MonoCon · CARLA shifting 10≤z≤15 | Det@80: 27.42% -> 27.42% | No clear effect |
| Smooth the model with Gaussian augmentation and median smoothing | FocalsConv · CARLA shifting 10≤z≤12 | AP@50: 0.00% -> 100.00% | Helped |
| Use CLOCs rather than SECOND | CARLA shifting certification · CARLA shifting | Det@80 | Helped |
Surprising findings
- FocalsConv, despite being a camera-LiDAR fusion model, performs poorly under shifting transformations, suggesting fusion design matters more than fusion per se.
- Fusion models are not uniformly more robust; FocalsConv's IoU certification is weaker than CLOCs and sometimes single-modal models.
Limitations
- Certification relies on a fine-partition assumption that is only empirically verified, not proven.
- Certification cost is high due to space partitioning and many Monte-Carlo samples.
- Evaluation limited to a single-vehicle detection task in simulation with two transformations.
Experimental setup
Datasets: KITTI-CARLA
Benchmarks: KITTI-CARLA
Metrics: Det@80 AP@50 certified lower bound of detection rate certified IoU lower bound
Baselines: MonoCon SECOND CLOCs FocalsConv
Builds on: randomized smoothing median smoothing Gaussian augmentation
Closest papers by meaning
- Fusion Is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detection (ICLR 2024 · similarity 0.88)
- Position: Certified Robustness Does Not (Yet) Imply Model Security (ICML 2025 · similarity 0.85)
- On Single Source Robustness in Deep Fusion Models (NeurIPS 2019 · similarity 0.85)
- MMCert: Provable Defense against Adversarial Attacks to Multi-modal Models (CVPR 2024 · similarity 0.83)
- Resilient Sensor Fusion Under Adverse Sensor Failures via Multi-Modal Expert Fusion (CVPR 2025 · similarity 0.83)
- Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models (NeurIPS 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.