Cheating Stereo Matching in Full-scale: Physical Adversarial Attack against Binocular Depth Estimation in Autonomous Driving

2025-11-18

AI Summary

Physical adversarial attacks against stereo matching–based depth estimation in autonomous driving remain underexplored, particularly regarding full-scale, texture-aware 3D perturbations. Method: This paper introduces the first 3D physical adversarial attack tailored to binocular systems, achieving end-to-end interference with stereo matching via multi-view-consistent texture camouflage and geometrically aligned 3D rendering. It innovatively integrates fine-grained texture fusion with global optimization to jointly enhance attack stealthiness and cross-view robustness. Contribution/Results: Extensive experiments demonstrate substantial depth estimation errors across mainstream stereo matching models. The attack maintains high success rates and visual seamlessness in real-world driving scenarios, establishing a novel paradigm for security evaluation of binocular perception systems.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Though deep neural models adopted to realize the perception of autonomous driving have proven vulnerable to adversarial examples, known attacks often leverage 2D patches and target mostly monocular perception. Therefore, the effectiveness of Physical Adversarial Examples (PAEs) on stereo-based binocular depth estimation remains largely unexplored. To this end, we propose the first texture-enabled physical adversarial attack against stereo matching models in the context of autonomous driving. Our method employs a 3D PAE with global camouflage texture rather than a local 2D patch-based one, ensuring both visual consistency and attack effectiveness across different viewpoints of stereo cameras. To cope with the disparity effect of these cameras, we also propose a new 3D stereo matching rendering module that allows the PAE to be aligned with real-world positions and headings in binocular vision. We further propose a novel merging attack that seamlessly blends the target into the environment through fine-grained PAE optimization. It has significantly enhanced stealth and lethality upon existing hiding attacks that fail to get seamlessly merged into the background. Extensive evaluations show that our PAEs can successfully fool the stereo models into producing erroneous depth information.

Problem

• Physical adversarial attack on stereo matching models for autonomous driving
• Creating 3D adversarial examples with global camouflage texture instead of 2D patches
• Fooling stereo models to produce erroneous depth estimation in real-world scenarios

Innovation

• 3D adversarial texture for stereo matching
• Stereo rendering aligns attack with binocular vision
• Merging attack optimizes stealth and background integration