Search papers, labs, and topics across Lattice.
This paper introduces TwinIR, a novel attack methodology that targets online HD map construction for autonomous driving by exploiting a cross-boundary compensation effect. By optimizing the placement and number of attack points, TwinIR effectively suppresses compensating geometric cues while minimizing perceptibility through near-infrared illumination. Experimental results demonstrate that TwinIR significantly degrades map accuracy and increases unsafe driving scenarios, highlighting its effectiveness against state-of-the-art online map construction models and real-world autonomous vehicles.
TwinIR can degrade HD map accuracy by nearly 9% while remaining nearly invisible to the human eye, posing a significant threat to autonomous driving safety.
Online HD map construction is critical to prediction and planning in autonomous driving. We find that existing physical attacks against online map construction are limited by a cross-boundary compensation effect: after the target boundary is perturbed, another visible boundary may retain sufficient geometric cues for the model to recover the original road geometry. Based on this observation, we propose TwinIR, a new mechanism-guided physical attack methodology for online map construction. TwinIR jointly optimizes attack effectiveness and point sparsity, seeking the minimum number of attack points needed to suppress compensating geometric cues from surrounding boundaries. To reduce the perceptibility of multi-point attacks, TwinIR models camera responses to near-infrared illumination and maps optimized attack points to feasible physical placements, producing camera-visible interference with minimal visible-spectrum changes. Experiments on nuScenes across state-of-the-art online map construction models show that TwinIR reduces mAP by 8.18-8.96 percentage points under RSA and 2.84-5.62 points under ETA, while increasing the unreachable-goal rate by 25-28 points and the unsafe-planned-trajectory rate by 19-20 points over clean inputs. These attacks are also validated on a real-world testbed AV, where TwinIR successfully induces both road straightening and early-turn deformations while remaining inconspicuous in full-color views.
