FlowCraft: Unveiling adversarial robustness of LiDAR scene flow estimation

Abstract

With the arrival of deep learning and advanced sensor technologies, the autonomous vehicle domain has gained increased research interest. In particular, deep learning networks developed based on 3D LiDAR sensing data for perception and planning in autonomous vehicles demonstrate remarkable performance. However, recent research reveals vulnerabilities in LiDAR-based perception tasks, such as 3D object detection and segmentation, to intentionally crafted adversarial perturbations. Yet, the adversarial robustness of LiDAR-based regression tasks like scene flow estimation, remains largely unexplored. Therefore, this study introduces a novel point perturbation attack named FlowCraft, based on two loss functions, along with a critical analysis of selecting the adversarial objective against scene flow estimation. In particular, evaluations are conducted on trainable, runtime optimization, supervised, and self-supervised scene flow estimation methods using the Argoverse 2 and Waymo datasets in both black-box and white-box settings. Experimental results on the Argoverse 2 benchmark dataset and the DeFlow network show that FlowCraft achieves a relative endpoint error increment of 2.9, while demonstrating a higher endpoint error increase of 5.5 per unit change in Chamfer Distance compared to PGD and CosPGD attacks. Furthermore, our results demonstrate that the performance of point perturbation attacks against runtime optimization methods involves a trade-off between their success rate and overall imperceptibility.