Still Camouflage, Moving Illusion: View-Induced Trajectory Manipulation in Autonomous Driving

2026-05-12

AI Summary

This work addresses the limitations of existing physical adversarial attacks on vision-based autonomous driving systems, which often rely on complex multi-view optimization or dynamic patches that are difficult to deploy and sensitive to viewpoint variations. The authors propose a novel static, passive camouflage approach that leverages the natural viewpoint shifts induced by relative vehicle motion as an intrinsic attack mechanism. By applying view-dependent static adversarial patterns onto a target vehicle, the method subtly induces feature drift in the perception system during normal driving, leading it to infer physically plausible yet erroneous trajectories—such as false cut-ins—that trigger downstream emergency braking. Notably, this technique requires neither multi-view robustness nor active intervention, achieving an 87.5% hard-braking success rate on the nuScenes dataset and demonstrating strong robustness across diverse backgrounds, speeds, and perception models.

Abstract

Existing physical adversarial attacks on vision-based autonomous driving induce time-evolving perception errors, including biased object tracking or trajectory prediction, through (i) sophisticated physical patch inducing detection box drift when entering the view distance, or (ii) dynamically changing patches that cause different perception errors at different time. In both cases, viewing-angle variation is treated as a challenge, requiring adversarial patches to remain effective across frames under varying views, leading to complex multi-view optimization. In contrast, we show that viewing-angle variation itself can be turned into an attack tool. We design a new attack paradigm where a static, passive adversarial camouflage is mounted on a vehicle whose view-dependent appearance naturally evolves with relative motion, inducing consistent feature drift across frames. This causes the system to infer a physically plausible but incorrect trajectory, such as a false cut-in, which propagates to downstream decision-making and triggers unnecessary braking. Unlike prior approaches that require multi-view robustness or active intervention, our attack emerges from normal driving dynamics and is easy to deploy: a parked vehicle with a natural camouflage can induce hard braking in passing autonomous vehicles. We demonstrate the novel attack on nuScenes dataset, showing the effectiveness with an end-to-end success rate of up to 87.5%, measured by hard-braking events, and robustness across different scene backgrounds, victim vehicle speeds, and perception models.

Problem

• adversarial attack
• autonomous driving
• view-induced trajectory manipulation
• physical camouflage
• perception error

Innovation

• view-induced trajectory manipulation
• static adversarial camouflage
• physical adversarial attack
• autonomous driving perception
• feature drift