Search papers, labs, and topics across Lattice.
This paper introduces AdROD, a novel defense mechanism for camera-based object detection in autonomous driving that addresses vulnerabilities to physical adversarial attacks. By utilizing low-rank HyperNetworks to create diverse detectors with a minimal parameter footprint, AdROD enhances robustness without sacrificing real-time performance. The system's unique functional diversity mechanism and two operational modes allow it to effectively recover from compromised detections while outperforming existing defenses in various testing scenarios.
AdROD achieves superior adversarial robustness with only 1.6% of the parameter footprint of traditional HyperNetworks, making it a game-changer for real-time object detection in autonomous vehicles.
Camera-based object detectors are vulnerable to physical adversarial attacks designed to suppress detections. While adversarial training and input purification offer some protection, they often overfit to specific attack distributions and fail on adaptive adversaries. This paper presents AdROD, an embedded, stochastic ensemble defense software designed for autonomous driving. AdROD employs {\em low-rank HyperNetworks}, which require only 1.6\% of the parameter footprint of standard HyperNetworks, to generate diverse detectors at a per-frame rate, making it impractical for attackers to obtain the deployed detectors in time. To further improve adversarial robustness, AdROD incorporates a novel \emph{functional diversity} mechanism, which couples stochastic weight updates with unique input-space transformations. We design two serving modes of AdROD that strike different trade-offs between robustness and runtime overhead: AdROD-I, a continuous protection mode for maximum resilience that leverages inter-detector disagreement to recover compromised detections, and AdROD-II, an on-demand mode triggered by kinematic discontinuities in object tracking. Through comprehensive evaluation with synthetic benchmarks, physically deployed adversarial patches, and end-to-end safety tests in the OpenCDA co-simulator, AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.
