Transferable universal adversarial attack against 3D object detection with latent feature disruption

Abstract

3D object detection models are highly vulnerable to adversarial attacks, which expose their weaknesses and when addressed, help improve the robustness of the models. Existing adversarial attack methods against LiDAR scene are typically optimized for a single sample and perform poorly in terms of transferability. Adversarial attacks with universal and transferable abilities can bring further guidelines for the robustness study of 3D object detection. In this paper, we propose a universal adversarial perturbation attack against 3D object detection models, which suppresses the detection results and disrupts the latent features simultaneously. Specifically, the universal adversarial perturbation is generated to launch sample-agnostic attacks, which is encoded in elaborate perturbation voxel units and is adaptive to varying scales of LiDAR scenes, as well as 3D object detectors with different point cloud representations. The proposed transferable attack focuses on the latent feature space and deviates the detectors at outputs of shallow layers. Moreover, a layer activation loss function is designed, which suppresses the significant features extracted by the backbone network. Extensive experiments on multiple popular 3D object detectors and large-scale datasets demonstrate that the proposed method achieves superior attack success rates, exposing critical robustness issues in current LiDAR-based 3D object detection models.