Search papers, labs, and topics across Lattice.
This study conducts a comprehensive analysis of the adversarial robustness of LiDAR-based 3D object detection models, addressing a critical gap in the evaluation frameworks that traditionally focus solely on mean Average Precision (mAP). By introducing a holistic framework that incorporates both structural and predictive factors, the authors empirically assess the vulnerability of various state-of-the-art models to adversarial attacks. The key finding reveals that high-capacity, voxel-based detectors are particularly susceptible to structured coordinate perturbations, highlighting the urgent need for improved training techniques and evaluation benchmarks that consider adversarial robustness alongside detection accuracy.
High-capacity LiDAR detectors are more vulnerable to adversarial attacks than their predecessors, challenging the assumption that newer models are inherently more robust.
Recent advancements in LiDAR-only 3D object detection have demonstrated improved detection accuracy over benchmark datasets. However, the adversarial robustness of these models remains untested. Very few adversarial robustness studies exist for LiDAR-only 3D object detection and unfortunately, even they are limited to legacy models. Moreover, there is a systemic gap in the existing evaluation frameworks that rely simply on mAP ignoring other structural and predictive factors. To fill this gap, we propose a holistic framework that evaluates adversarial robustness using two structural factors (point cloud density and point cloud localization) and three predictive factors (misclassification, localization error, distance from ego). Using this framework, we perform an empirical study and critical analysis on recent and legacy state-of-the-art models using adversarial attacks specifically designed for LiDAR-based models. Our key finding is that high-capacity, voxel-based detectors are more susceptible to structured coordinate perturbations than pillar-based detectors. Additionally, non-anchor-based detectors demonstrate poor adversarial robustness, which necessitates rethinking model training techniques. Overall, our results demonstrate that recent models are as vulnerable to adversarial attacks as their predecessors. Therefore, we argue that there is a need to improve the evaluation benchmarks for 3D object detection that not only reward architectural modifications for improving detection accuracy, but also evaluate whether the design choices improve adversarial robustness.
