AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Driving

2026-08-16

AI Summary

This study addresses the vulnerability of autonomous driving detectors to physical adversarial attacks and the limited generalization of existing defenses by proposing AdROD, an embedded stochastic ensemble defense framework. Leveraging low-rank hypernetworks to generate diverse detectors per frame, AdROD integrates functional diversity mechanisms with kinematic triggering strategies to offer both continuous and on-demand service modes, effectively balancing robustness against computational overhead. Experimental results demonstrate that AdROD significantly outperforms five baseline methods, exhibiting strong generalization and real-time capability under adversarial patch attacks. Notably, it ensures safe vehicle stopping in adversarial scenarios, providing an efficient solution for enhancing perception security in autonomous driving systems.

Abstract

Camera-based object detectors are vulnerable to physical adversarial attacks designed to suppress detections. While adversarial training and input purification offer some protection, they often overfit to specific attack distributions and fail on adaptive adversaries. This paper presents AdROD, an embedded, stochastic ensemble defense software designed for autonomous driving. AdROD employs {\em low-rank HyperNetworks}, which require only 1.6\% of the parameter footprint of standard HyperNetworks, to generate diverse detectors at a per-frame rate, making it impractical for attackers to obtain the deployed detectors in time. To further improve adversarial robustness, AdROD incorporates a novel \emph{functional diversity} mechanism, which couples stochastic weight updates with unique input-space transformations. We design two serving modes of AdROD that strike different trade-offs between robustness and runtime overhead: AdROD-I, a continuous protection mode for maximum resilience that leverages inter-detector disagreement to recover compromised detections, and AdROD-II, an on-demand mode triggered by kinematic discontinuities in object tracking. Through comprehensive evaluation with synthetic benchmarks, physically deployed adversarial patches, and end-to-end safety tests in the OpenCDA co-simulator, AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.

Problem

• Adversarial Robustness
• Object Detection
• Autonomous Driving
• Physical Adversarial Attacks

Innovation

• Low-rank HyperNetworks
• Functional Diversity
• Stochastic Ensemble
• Adversarially Robust Object Detection
• Autonomous Driving