Venue: CoRL 2023 Conference

Reviews:

final_score: rating: Weak Reject: I recommend rejecting the paper, but will not argue for my recommendation if the majority of other reviewers have a different opinion.
review_content: summary_of_paper: This paper proposes Adv3D, a framework to stress-test autonomous driving approaches by generating challenging shapes of the road user immediately in front of the autonomous vehicle in a simulator. In doing so, Adv3D challenges LIDAR-based perception stacks as it manipulates the appearance towards shapes that harm the performance of the autonomy stack. 

The shape manipulation is performed using adversarial shape optimization, where a learned latent 3D encoding of a vehicle is iteratively updated using Bayesian optimization such that the overall autonomy performance drops significantly in simulation.

The proposed approach is evaluated on a dataset containing 100 driving sequences, each 20s in duration. Each segment is replayed in a simulator while the LIDAR data is modified. To measure the impact of this altered sensor data, two perception systems are tested, both showing degraded performance when deployed on manipulated data.
review: Strenghts
=================
- The use of a low-dimensional latent code for object shape parameterization and restricting the search space to realistic vehicle shapes is an elegant approach to mining difficult examples for stress-testing autonomous vehicles.
- In general, the paper is written clearly and reads well.
- The figures are well made and illustrate the generated adversarial shapes well. 

Constructive Criticism
====================
- The paper states that their method attacks the full autonomy stack. This statement is misleading in my opinion. The presented approach attacks the perception stack and closes the loop in simulation. Just closing the loop does not mean it attacks the full autonomy stack. Attacking the full autonomy stack would also include alterations to simulation such as the behavior of other road users or the dynamics of the simulated vehicle.

- In Table 2, what method is being tested in this table? From my understanding, each row corresponds to a method that manipulates the LIDAR data, but what approach is used for perception and planning? Why do some rows contain contradicting results? For example: the second row (M1) results in very low AP and Recall, but performs best in lateral acceleration and second-to-best in jerk. It would be interesting to understand where this discrepancy is coming from. Extending the caption of table 2 to be more self-contained would help the reader understand the presented data. In general, more interpretation of the presented results would greatly improve the paper IMO.

- The adversarial shape modification is based on a dataset of real-world LIDAR data and CAD assets. It would be interesting to understand how the performance obtained from the generated adversarial shapes compares to the performance obtained when using the original assets. Do the adversarial shapes degrade performance more than any shape existing in the dataset?

- This is a very minor comment, but I wouldn't call 2000s or highway data a large-scale dataset.
robotics_focus: Relevant but unlikely to deploy to hardware in near future
quality_of_the_limitations_section: Limitations are addressed clearly
summary_of_recommendation: The basis for my recommendation is comprised of the following observations:
- The paper provides a limited interpretation of the presented results. Especially if the results are contradicting (such as Table 2), the paper should provide more interpretation and analysis of the obtained results. 
- The paper makes the misleading claim of attacking the entire autonomy stack, even though the presented adversarial attacks are limited to perception.
review_title: null

final_score: rating: Strong Accept: I recommend accepting the paper and will argue for my recommendation even if other reviewers hold a different opinion.
review_content: summary_of_paper: This paper presents an adversarial shape attack pipeline that targets the whole autonomous vehicle stack consisting of perception, prediction, and planning. The adversarial shape is searched by mapping a suite of common shapes into a latent space and performing a search there. Specifically, the authors starts from  CAD assets and turn them into SDFs, then apply PCA on the SDFs to obtain a latent representation together with the principal axes.

The simulation environment uses raycasting to simulate Lidar point cloud, then the AV either takes an instance-based stack to predict the environment motion and plan its own motion, or takes an implicit occupancy-based approach to plan its motion. The other agents follow a traffic model.

The adversarial search uses a Bayesian optimization approach that targets the whole stack and the result shows that the proposed approach is able to generate more realistic adversarial shapes than the baseline, and closed-loop training is superior. 
review: Overall I think the paper is solid and well-written. The approach makes sense and the engineering effort is impressive. While closed-loop simulation remains challenging for a gradient-based approach to train on, the BO approach can certainly work. The SDF-then-PCA approach for generating adversarial shape is interesting and novel albeit simple. The experiments are well-designed with a high level of engineering implementation. The result shows the benefit of the approach, although I do have some questions (see next section).
robotics_focus: Highly relevant to robotics but no hardware experiments
quality_of_the_limitations_section: Limitations are addressed clearly
summary_of_recommendation: I think this paper proposes an interesting approach to adversarial attacks on AV. Particularly, the PCA approach that uses actual CAD assets is novel and significantly improves the realism of the adversarial shape attack. The engineering effort is commendable given that the authors built a functional closed-loop simulator with sensor simulation, a complete AV stack, and a traffic model for other agents. The results are nicely explained and make sense to me. Overall, I find this paper well-written, the research of high quality, and suitable to be published in CoRL.
review_title: null

final_score: rating: Weak Reject: I recommend rejecting the paper, but will not argue for my recommendation if the majority of other reviewers have a different opinion.
review_content: summary_of_paper: This paper introduces a novel framework for adversarially attacking self-driving vehicle autonomy systems, ADV3D. It focuses on LiDAR-based systems and tried to attack and evaluate the full stack of self-driving autonomy systems, including perception, prediction, and planning. It attacks the system by generating realistic adversarial vehicle shapes around the autonomous agent. The adversarial vehicle shape is optimized in the latent space through a simple PCA-based vehicle shape encoder-decoder framework. Unlike previous methods, the proposed optimization takes into account the so-called closed-loop performance loss of the autonomous vehicle simulation. The experiments demonstrate its effectiveness in finding worse failure cases than baseline approaches in a captured dataset including 100 real autonomous driving scenes.
review: I summarize the strengths and weaknesses of the paper below.

**Strength**:

1. The paper investigates an important problem (i.e. adversarial attacking) in self-driving to evaluate the robustness of autonomous driving systems. 

2. The idea of evaluating the performance of the system in a closed-loop manner is insightful.

3. The experiments are well designed to demonstrate the effectiveness of various components of the method.

**Weaknesses** and **Questions**:

1. The main contribution of the paper seems to be incremental: a) a simple PCA-based latent space. b) a loss function taking into account the future trajectory of SDV induced by the modified vehicle shape.

2. The definition of $W$ in Eq (2) is unclear. I suppose it is the PCA components computed from the whole CAD dataset?

3. The selection of the PCA-based latent space of the vehicle shape needs more justification. The encoder/decoder in Eq (2) seems to not guarantee obtaining the same/similar output shape from a given input shape since $W$ is not invertible. Furthermore, how does this simple encoder/decoder approach compare to more sophisticated neural network based models (VAE)? It is necessary to include such experiments to validate the selection of the PCA-based latent space.

4. The reason for selecting the closest actor in front of the SDV to be modified needs more discussion. The agents aside the SDV might also have a significant impact in the system's performance. Optimizing the selection of the modified actor(s) can be a valuable option.

5. Figure 4 is hard to interpret. It is unclear how the green and blue arrows related to perception and prediction failures. And the numbers in the figure are also not defined.

6. The comparison against vertex-wise noise baseline would be more meaningful if the average performance over the whole dataset is reported. Currently, it is biased since it only compares the methods on the ADV3D's best data. Also, did the authors also apply optimization over the vertex-wise noise for the baseline?

7. The advantage of the proposed approach over the existing method is unclear. From Table 2, while the proposed method is averagely good across metrics, it is not the best one in most of them. Can we achieve better results by simply combining existing methods?

8. How is the scalability of the method to multiple modified actors? In other words, hoe many optimization iterations are required to achieve a good result (compared to the baseline) when the number of modified actors increases?


robotics_focus: Highly relevant to robotics but no hardware experiments
quality_of_the_limitations_section: Limitations are addressed clearly
summary_of_recommendation: I am slightly on the negative side of the recommendation due to the weaknesses and questions I have raised above. The major concerns are the significance of the contribution and the justification of the algorithm design choice.
review_title: null

final_score: rating: Weak Accept: I recommend accepting the paper, but will not argue for my recommendation if the majority of other reviewers have a different opinion.
review_content: summary_of_paper: This paper proposes a framework (ADV3D) that performs closed-loop sensor simulations for evaluating self-driving vehicles (SDVs). This framework focuses on LiDAR-based data. The proposed framework utilizes a low-dimensional shape representation to modify the vehicle shape. The experiments show that ADV3D is able to generate challenging actor shapes. Moreover, it is shown that the closed-loop is more powerful than attacking in the open-loop. 
review: The problem studied in this paper is interesting. The supplementary materials and the video are helpful to understand the proposed algorithm. 

Some comments are as follows:
- In Sec. 3.2, the actor is placed using the pose based on S_t. Does this pose is known or it needs to be optimized?
- Table 2 and Table 3 are a bit confusing. It seems that the proposed method does not outperform existing methods in general.
- Typo in Sec. 3.2 paragraph 3. 
robotics_focus: Highly relevant to robotics but no hardware experiments
quality_of_the_limitations_section: Additional details required
summary_of_recommendation: Please refer to my review comments above.
review_title: null

Meta-review: The reviews for this paper were a bit diverging. The reviewers generally agree that this paper addresses a timely problem (namely, that of stress-testing AV stacks) and is well executed, but also raise a number of concerns, in particular in terms of technical novelty. Upon reading the paper, the AC believes that the "system-level" contribution of this paper is indeed notable and outweighs its rather limited technical contribution. Thus, the AC recommends acceptance. In the final version of this paper, the authors should carefully revise the paper to address all reviewers' comments / suggestions.
Decision: Accept (Poster)