Physical Adversarial Attack on Monocular Depth Estimation via Shape-Varying Patches

Abstract

Adversarial attacks against monocular depth estimation (MDE) systems, which serve as critical visual sensors in autonomous driving and various safety-critical applications, pose significant challenges. These depth cameras provide essential distance information, enabling accurate perception and decision-making. Existing patch-based adversarial attacks for MDE are confined to the vicinity of the patch, limiting their impact on the entire target. To address this limitation, we propose a physics-based adversarial attack on MDE using a framework called an attack with shape-varying patches (ASP). This framework optimizes the content, shape, and position of patches to maximize its disruptive effectiveness on the sensor’s output. We introduce various mask shapes, including quadrilateral, rectangular, and circular masks, to enhance the flexibility and efficiency of the attack. In addition, we propose a new loss function to extend the influence of patches beyond the overlapping regions. Experimental results demonstrate that our attack method generates an average depth error of 18 m on the target car with a patch area of 1/9, impacting over 98% of the target area. This work underscores the vulnerability of visual sensors, such as depth cameras, to adversarial attacks and highlights the imperative for enhanced security measures in sensor technology to ensure reliable and safe operation.