Invisible Triggers, Visible Threats! Road-Style Adversarial Creation Attack for Visual 3D Detection in Autonomous Driving

2025-11-11

AI Summary

RGB-camera-based 3D object detectors are vulnerable to adversarial attacks, yet existing adversarial posters suffer from poor naturalness, low imperceptibility, and weak generalization. To address this, we propose a road-texture-adaptive two-stage adversarial poster generation method. In the first stage, photorealistic road surface appearance is synthesized via style transfer and road texture modeling. In the second stage, scene-aware perturbation optimization enables position- and illumination-adaptive adversarial perturbation injection. Our method preserves human imperceptibility while significantly improving cross-model, cross-scene, and cross-location attack generalization. Experiments demonstrate high attack success rates across mainstream 3D detectors—including PointPillars and CenterPoint—on both synthetic and real-world driving datasets (e.g., nuScenes). Physical-world evaluations further confirm its stealthy threat under realistic road conditions.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web

Abstract

Modern autonomous driving (AD) systems leverage 3D object detection to perceive foreground objects in 3D environments for subsequent prediction and planning. Visual 3D detection based on RGB cameras provides a cost-effective solution compared to the LiDAR paradigm. While achieving promising detection accuracy, current deep neural network-based models remain highly susceptible to adversarial examples. The underlying safety concerns motivate us to investigate realistic adversarial attacks in AD scenarios. Previous work has demonstrated the feasibility of placing adversarial posters on the road surface to induce hallucinations in the detector. However, the unnatural appearance of the posters makes them easily noticeable by humans, and their fixed content can be readily targeted and defended. To address these limitations, we propose the AdvRoad to generate diverse road-style adversarial posters. The adversaries have naturalistic appearances resembling the road surface while compromising the detector to perceive non-existent objects at the attack locations. We employ a two-stage approach, termed Road-Style Adversary Generation and Scenario-Associated Adaptation, to maximize the attack effectiveness on the input scene while ensuring the natural appearance of the poster, allowing the attack to be carried out stealthily without drawing human attention. Extensive experiments show that AdvRoad generalizes well to different detectors, scenes, and spoofing locations. Moreover, physical attacks further demonstrate the practical threats in real-world environments.

Problem

• Generating road-style adversarial posters to deceive visual 3D detectors
• Creating stealthy attacks that resemble road surfaces to avoid human detection
• Ensuring adversarial examples generalize across detectors, scenes, and locations

Innovation

• Generates road-style adversarial posters
• Uses two-stage approach for stealthy attacks
• Ensures natural appearance to avoid detection