Asymmetry Vulnerability and Physical Attacks on Online Map Construction for Autonomous Driving

2025-09-07

AI Summary

This paper identifies a critical vulnerability in online high-definition (HD) map construction models under adversarial conditions: their inherent symmetry bias causes erroneous road boundary predictions at asymmetric scenarios—such as road forks and merges—severely compromising the robustness of autonomous driving systems. To expose this vulnerability, we propose the first two-stage cross-domain attack framework tailored for HD map construction, integrating camera-blinding perturbations with physically realizable adversarial patches to jointly disrupt digital inputs and sensor perception. Through adversarial sample generation, sensor interference optimization, and root-cause attribution analysis—including data distribution, model architecture, and map representation—we systematically validate the origin and impact of the flaw. On public benchmarks, map accuracy degrades by up to 9.9%, target route reachability drops to 56% (i.e., 44% failure rate), and motion planning collision rate increases by 27%. End-to-end attack validation is further conducted on a real vehicle platform.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web

Abstract

High-definition maps provide precise environmental information essential for prediction and planning in autonomous driving systems. Due to the high cost of labeling and maintenance, recent research has turned to online HD map construction using onboard sensor data, offering wider coverage and more timely updates for autonomous vehicles. However, the robustness of online map construction under adversarial conditions remains underexplored. In this paper, we present a systematic vulnerability analysis of online map construction models, which reveals that these models exhibit an inherent bias toward predicting symmetric road structures. In asymmetric scenes like forks or merges, this bias often causes the model to mistakenly predict a straight boundary that mirrors the opposite side. We demonstrate that this vulnerability persists in the real-world and can be reliably triggered by obstruction or targeted interference. Leveraging this vulnerability, we propose a novel two-stage attack framework capable of manipulating online constructed maps. First, our method identifies vulnerable asymmetric scenes along the victim AV's potential route. Then, we optimize the location and pattern of camera-blinding attacks and adversarial patch attacks. Evaluations on a public AD dataset demonstrate that our attacks can degrade mapping accuracy by up to 9.9%, render up to 44% of targeted routes unreachable, and increase unsafe planned trajectory rates, colliding with real-world road boundaries, by up to 27%. These attacks are also validated on a real-world testbed vehicle. We further analyze root causes of the symmetry bias, attributing them to training data imbalance, model architecture, and map element representation. To the best of our knowledge, this study presents the first vulnerability assessment of online map construction models and introduces the first digital and physical attack against them.

Problem

• Online HD map construction models exhibit symmetry bias vulnerability
• Asymmetric road scenes cause erroneous straight boundary predictions
• Physical attacks exploit this vulnerability to degrade mapping accuracy

Innovation

• Systematic vulnerability analysis of online map models
• Two-stage attack framework exploiting symmetry bias
• Camera-blinding and adversarial patch attacks optimization