Exploring Adversarial Robustness of Multi-sensor Perception Systems in Self Driving
Authors: James Tu
Huichen Li
Xinchen Yan
Mengye Ren
Yun Chen
Ming Liang
Eilyan Bitar
Ersin Yumer
Raquel Urtasun
Venue: CoRL2021 Poster (2021)
Keywords: Adversarial
Self-Driving
Detection
Multimodal

Abstract: Modern self-driving perception systems have been shown to improve upon processing complementary inputs such as LiDAR with images. In isolation, 2D images have been found to be extremely vulnerable to adversarial attacks. Yet, there are limited studies on the adversarial robustness of multi-modal models that fuse LiDAR and image features. Furthermore, existing works do not consider physically realizable perturbations that are consistent across the input modalities. In this paper, we showcase practical susceptibilities of multi-sensor detection by inserting an adversarial object on a host vehicle. We focus on physically realizable and input-agnostic attacks that are feasible to execute in practice, and show that a single universal adversary can hide different host vehicles from state-of-the-art multi-modal detectors. Our experiments demonstrate that successful attacks are primarily caused by easily corrupted image features. Furthermore, in modern sensor fusion methods which project image features into 3D, adversarial attacks can  exploit  the projection process to generate false positives in distant regions in 3D. Towards more robust multi-modal perception systems, we show that adversarial training with feature denoising can boost robustness to such attacks significantly.

Exploring Adversarial Robustness of Multi-sensor Perception Systems in Self Driving
1,2 James Tu
Huichen Li Xinchen Yan 1.2 Mengye Ren 1.2 Yun Chen
Ming Liang
Eilyan Bitar Ersin Yumer 1.2 Raquel Urtasun
Waabi University of Toronto UIUC Comelll University
(itu, mren, yua, urtasun)@css srcasuuneccs.orrnttoo... www.ntorrtoooooo.oo huichen:8illimcis....
eybSecornell.ee
(skywalkeryxo, liangming el elgoog, meyumer ) @egmall.com
Abstract: Modern self-driving perception systems have been shown to improve upon processing complementary inputs such as LiDAR with images. In isolation, 2D images have been found be extremely vulnerable adversarial attacks. Yet, there are limited studies on the adversarial robustness of multi-modal models that fuse LiDAR and image features. Furthermore, existing works do not consider physically realizable perturbations that are consistent across the input modalities. In this paper, we showcase practical susceptibilities of multi-sensor detection by inserting an adversarial object on host vehicle. We focus on physically realizable and input-agnostic attacks that are feasible to execute in practice, and show that a single universal adversary can hide different host vehicles from state-of-the multi modal detectors. Our experiments demonstrate that successful attacks are primarily caused by easily corrupted image features. Furthermore, in modern sen- sor fusion methods which project image features into 3D, adversarial attacks can exploit the projection process to generate false positives in distant regions in 3D. Towards more robust multi-modal perception systems, we show that adversarial training with feature denoising can boost robustness to such attacks significantly.
Keywords: Adversarial, Self- Self-Driving, Perception, Multimodal
Introduction
Recent advances in self-driving perception have shown that fusing information from multiple sensors (c.g., camera, LiDAR, radar) [1, 2, 3, 4, 5, 6] leads to superior performance when compared to relying on single sensory inputs. Such performance gains primarily due the complementary information contained in the measurements provided by the different types of sensors. For example, LiDAR sensors provide accurate 3D geometry while cameras capture rich appearance information.
Meanwhile, modern perception models which rely on deep neural networks (DNNs) have been found to be extremely vulnerable to adversarial attacks when processing images in isolation [7, 8, 9, 10, 11]. Adversarial attacks can be thought of as perturbations to the sensory inputs which do not alter the semantic meaning of the scene, but drastically change DNN's output and resulting in incorrect predictions. Such vulnerabilities can lead to catastrophic consequences in safety-critical applications. In the context of self-driving, most efforts have investigated attacks against single- sensor inputs, such as image-only attacks [7, 11] and LiDAR-only attacks [12]. Towards multi- modal robustness, [13] considers perturbations of LiDAR and image inputs independently, resulting in perturbations that are inconsistent across modalities and therefore may not be physically realizable
and hence not threatening in practice. On the other hand, some proposed physically realizable approaches [14] only search over shape but ignore texture which is crucial for corrupting image inputs. Furthermore, these prior works do not generate universal perturbations which perhaps the most threatening in practice. Such perturbations are input agnostic and can attack any input in the training distribution with high probability, meaning they can be executed without prior knowledge of the scene and are able to consistently disrupt models that process sensory information across time.
Work done while authors were UberATG.
5th Conference on Robot Learning (CoRI. 2021), London, UK.

---

Image Casture
Roottop Pase Approximation
Depth completion
Environment Lighting
Denze Depth Imaaee
LIDAR Osclusion
Image Dcslusion
Figure 1: Simulating the addition of a mesh onto a vehicle rooftop in a realistic manner. First roof approximation done to determine placement location and heading. Then LiDAR points and pixels are rendered with directional lighting to approximate sunlight. Finally, a dense depth image generated with depth completion and used to handle occlusion.
This paper demonstrates the susceptibility of multi-sensor detection models to physically realizable and imput-agnostic adversarial perturbations. To create physically realizable attack which is also feasible execute, we focus on object insertion attacks [7, 15, 16, 17, 12], as they can be carried out via the deployment of physical objects in the real world. Following [12], we insert the adversarial object by placing it on the rooftop of a host vehicle. We render the adversary into LiDAR and image inputs to ensure perturbations are consistent across modalities and that our attack is physically real- izable. Furthermore, we consider occlusion and environmental lighting in the rendering process as shown in Figure I to enhance the realism of simulation. To enable end-to-end learning of geometry and texture, we render the pixels and LiDAR points in a differentiable manner. During training, our adversary is optimized with respect to all vehicles in the training distribution to create a universal attack which can be applied to any vehicle in any scene.
We conduct an empirical evaluation of our proposed attack on the KITTI [18] self-driving dataset and a novel large-scale self-driving dataset XENITH using the multi-sensor detector MMF [5]. We generate input-agnostic adversarial examples that successfully hide host vehicles from state-of-the- art detectors in both datasets. More importantly, we find that incorporating image inputs makes models more vulnerable when compared to using LiDAR alone, successful attacks are primarily caused by the brittle image features. Moreover, the projection of image features into 3D allows the adversary to generate false detections in distant regions. Nonetheless, we show that false negative failures can be circumvented by applying feature denoising and adversarial training. However, we observe that distant false positives are much harder to correct with adversarial defense, as they also caused by inaccurate mappings between 2D pixels and 3D LiDAR points during fusion.
2 Related work
Adversarial attacks were first discovered in the 2D image domain, where small perturbations on the pixels were shown to generate drastically different prediction results object classification [19, 20]. Networks trained on object detection and semantic segmentation have also been shown to exhibit such vulnerability [8, 9, 21, 22, 23, 24]. Early methods [19, 20, 25, 26] assume the perfect knowledge of the gradients of the victim model, referred to as whitebox attacks. Later it was found that a blackbox attack can achieve similar success well [27, 28, 29]. Defense and robustness evaluation procedures have also been explored for adversarial attacks [30, 31, 32, 33, 34, 35, 36, 37].
Aside from changing the pixel values by small amount, various other ways to "perturb" an image were also proposed. Object insertion attacks are realistic attacks that insert an object to change the network output while not introducing changes in semantics [38, 15, 7, 39, 40]. These attacks were originally designed to be stickers that can be attached to a target object, and has since also been applied to the lens of a camera [41]. Image rendering is another popular technique for non- pixel based attacks, which can also be made differentiable [42], by using which [43] showed that adversarial attacks can be made through changing lighting. Various other object insertion attacks designed camouflage textures that can be wrapped around the target object [44, 10, 45, 46, 47, 48).
Aside from the typical bmage-based attacks introduced above, adversarial attacks against point clouds have also been studied. [17, 49, 50, 51] tried to directly perturb the location and cardi- nality of point clouds. However, such attacks may not be physically realizable, as arbitrary per- turbations won't be achievable by a LiDAR sensor with fixed angular frequency. Towards more realistic attacks, [52, 53] developed spoofing attacks that add malicious LiDAR points, while other

---

Image
Multi Modal Octection
Mas Tostive
UDAR Simutation
Eacibiun
2003
Figure 2: Overview of the attack pipeline. The adversarial mesh is rendered into both LiDAR and image inputs in differentiable manner. The inputs are then processed by a multi-sensor detection model which outputs bounding box proposals. An adversarial loss is then applied to generate false negatives by suppressing correct proposals and false positives by encouraging false proposals. Since the entire pipeline is differentiable, gradient can flow from the adversarial loss to mesh parameters.
approaches [16, 54, 12] instead optimize 3D mesh surfaces and differentiable ray-casting to generate LiDAR point clouds.
Despite the fact that multi-modal sensor configurations are widely seen self-driving vehicles [55, 5, 56, 57, 58, 59], research on multi-modal sensor attacks is still very limited. Several preliminary works show the possibility of attacking multi-sensor fusion networks [13, 14, 60J. However, [13] did not consider consistency across data modalities when perturbing the image input, whereas [14] did not consider image texture, resulting in lack of attack expressivity, and [60] did neither. We believe that it would be an interesting question to ask, whether multi-sensor fusion can be made more robust when the attacks are both input-agnostic and physically realizable.
3 Multi-sensor Adversarial Learning
In this section, present general method for learning adversarial textured mesh to attack any multi-sensor object detector that differentiable end-to-end. Specifically, we require the adversarial attack to be (1) input-agnostic for different environments, (2) geometrically--oonissi and LiDAR input modalities, and (3) fully-automatic for implementation at large-scale. Our attacks
across image focused vehicles they are the most common object of interest the road.
Preliminaries: We consider a bird's eye view (BEV) object detection model F that takes the front camera image 2j E [o, 1 Hx Wxx x3 and LiDAR point clouds Ti. E Px3 as input x = (æ1, .T.). Here, the dimensions H and W represent the image height and width respectively. P is the number of LiDAR points which could vary in each frame. The object detector is trained on bird's eye view (BEV) bounding box annotations V, with each bounding box instance b y parameterized by b = (bz, by. bn, bw., b.). Subsequently, b, and b, are coordinates of the bounding box center, bn and bw indicate the width and height, respectively, and b, represents the orientation. In order process both image and LiDAR data modalities, the object detector uses two separate branches to extract features from each modality (see Fig 2). Then, the 2D image features are projected into 3D space to be fused with the LiDAR features.
3.1 Multi-sensor Simulation for Object Insertion
In this work, we design a framework to insert a textured mesh into the scene so that both appearance and shape can be perturbed to attack multi-sensor perception systems. We attach a triangle mesh M = -V, F, T) onto the roof of a host vehicle, such placement is physically realizable in the real world. The mesh is parameterized by vertex coordinates V R gxxx vertex indices of faces and face vertex textures E M MxCxXXX The dimensions N, M and C' represent
F FENMx, NMxx3 the number of vertices, the number of triangle faces, and the pace texture resolution, respectively. For scalability reasons, we do not consider transparency, reflective materials, or shadowing, as han- dling each case would require sophisticated physics-based rendering. Instead, we approximate the sensor simulation using LiDAR ray-tracing and a light- differentiable image renderer. Both image and LiDAR rendering pipelines are differentiable, allowing gradients from LiDAR points and

---

image pixels to flow into the mesh parameters during optimization. The overall pipeline of for object insertion illustrated in Figure 1.
First, we estimate the center of the vehicle's ss rooftop to determine the 3D) location for placing the adversary. Following [61, 12, 62], represent our vehicle objects using signed distance functions (SDFs) and further project them onto a low-dimensional shape manifold using PCA. For each vehicle, we then optimize the low-dimension latent code that minimizes the fitting error between the vehicle point clouds and the shape manifold. Then, a fitted SDF is converted to a watertight vehicle mesh with Marching Cubes [63]. We select the top 20cm of the vehicle as the approximate rooftop and use the rooftop center and vehicle heading to determine the exact pose for object insertion.
Rooftop Approximation:
To simulate insertion in the LiDAR sweep, we sample rays according to Li- DAR sensor specifications used to collect the original sweep, such as the number of beams and the horizontal rotation rate. We then compute the intersection of these rays and mesh faces using the Moller-Trumbore algorithm [64, 12] to obtain simulated point cloud of the adversarial mesh. These simulated points are then added to the original LiDAR sweep.
LiDAR Simulation:
To render the adversary into the image, we extract the intrinsics and extrinsics from the camera sensor that captured the original image. We then use a hight-weight differentiable renderer SoftRas [65] to simulate the mesh pixels. Using soft rasterizer during optimization allows gradient flow from occluded and far-range vertices to enable better 3D reasoning from pixel gradi- ents. To enhance the fidelity of rendered images, model the sun light with directional lighting model as a light at infinite distance.
Image Simulation:
As we insert a new object into the scene, the rendering process must also consider occlusion for both the original and newly rendered points and pixels. To handle LiDAR occlusions, we compare the depth of existing points in the LiDAR sweep and newly rendered points, discarding the point that farther away. Unlike LiDAR where the depth of each point is known, raw images do not contain depth information. To obtain depth estimates, first the LiDAR points are projected onto the image to generate a sparse depth image since images have higher resolution than LiDAR. We then use a depth completion model [66], which uses the sparse depths and RGB image to compute dense per-pixel depth estimates. With depth estimates of each pixel, we overlay rendered pixels onto the original image and discard occluded pixels. Note that we do not attack the depth completion model as it is a preprocessing step used to increase the fidelity of simulation.
Occlusion Reasoning:
3.2 Universal Adversarial Example Generation
Adversarial Objectives: We consider two adversarial objectives: one for false negatives and the other for false positives. To generate false negative attacks, we follow prior work [8, 12] in attacking object detectors by suppressing all relevant bounding box proposals for the host vehicle. A proposal is relevant its confidence score is greater than 0.1 and it overlaps with the ground bounding box. The adversarial loss then minimizes the confidence of all candidates:
fn adv
Σ
-loU(b, 6*) log(1 - score(b)). DE
(1)
where IoU denotes the intersection over union operator and b* is the corresponding ground-truth box we aim to attack.
Alternatively, we aim to generate false bounding box proposals that do not overlap with any ground- truth boxes the scene. The false positive adversarial loss increases the confidence of the false positive candidates as follows:
ChP DNED. log(1 score(b)) and
Dhp [blb E 5 and vb* E y s.t. IoU(b, 0},
where 5%p is a subset of bounding box proposals with no overlap with any ground-truth object bounding boxes.
Mesh Regularization: Besides the adversarial objective, we use an additional regularization term to encourage realism in the mesh geometry. Specifically, we use a mesh Laplacian regularizer [65], which encourages smooth object surface geometries: Liop = E, 11 with 5, as the distance from

---

XENITH
KITII
1.0
Recall
0.6
0.4
0.4
Ckez
Okai
0.2
Basdom
Randon
Ings
0.0
Bot
0.0
Boh
1.0
IoU
IoU
Figure 3:
Plot of the host vehicle recall across IoU thresholds. Only attacking LiDAR yields very weak attacks and attacking the image produces significantly stronger perturbations.
vertex e2 V to the centroid of its immediate neighbors A(): 8; U Lvllll Ejen(y) 2/- In addition Laplacian regularization. we also constrain the physical scale of the adversary with an axis-aligned 3D box. Namely, we require that |VV S T. for j {x, U, v}, where Ta by and I, represent the box constraints along zyz-axis, respectively.
Learning Input-Agnostic Attacks: Overall, our optimization objective can be summarized as L = t + Atp Chp + Clap. where App and Alap are coefficient that weight the relative importance of the false positive loss term and mesh regularization term. We employ this objective to optimize the shape and appearance of the inserted object on the entire dataset to generate an input-agnostic adversarial example. Therefore, we can denote the optimal adversary as the following equation:
[aa + App + Atap Lrup
M = arggmin E M 2.Y
With our proposed pipeline which is differentiable end-to-end, optimization of the adversarial mesh done using projected gradient descent to respect the foo constraints mesh vertices. In our experiments, we also conduct attacks targeting single modality. To achieve this, we disable the gradient flow to the untargeted input branch, while still simulate the mesh into both modalities to maintain physical consistency across image and LiDAR modalities.
3.3 Multi-sensor Adversarial Robustness
Towards defenses against object insertion attack, also study defense mechanisms. Compared to the single-sensor setting, achieving multi-sensor adversarial robustness even more challenging. First, each single input modality could be attacked even when the perturbations the other input sensors are non-adversarial. Second, adversarial perturbations from each single input modality can interact with each other, which is unique aspect in the multi-sensor setting. Thus, need to deal with not only perturbations at each input modality but also their effect the fusion layer.
We employ adversarial training is the most standard and reliable approach to defense. Adver- sarial training can be formulated as solving for model parameters
argmin E max (F Y.Y 5..L
(4)
which minimize the empirical risk under perturbation. Here Luss. is the loss function used to train the detection model. This is achieved by training detection model F against adversarial data 7 generated by our attack. While adversarial training is typically performed
image perturbations that are cheap to generate with only few PGD steps [67], our adversarial example generation is prohibitively expensive for the inner loop of the min-max objective. Thus, instead of generating strong adversary from scratch at every iteration, we adopt free adversarial training [68] and continuously update the same adversary to reduce computation.
5

---

ki
XENITH
Clean
Image
Porturbed Image
Perturbed
LIDAR
Figure 4: Placing the adversarial mesh on a host vehicle can hide the host vehicle completely from ofate-of-thh-art detectors. The same mesh is used for all vehicles in a dataset as the attack input- agnostic with respect to the training distribution.
4 Experimental Evaluations
In this section, we first describe the our datasets, attack protocols, and evaluation metrics. More de- tails on experiment setting are provided in the supplementary material. We then conduct experiments on the multi-sensor detection model MMF [5] and present our empirical findings for white-box at- tacks on each dataset and the black-box transfer attacks across datasets. Finally, we explore several defense mechanisms to achieve more robust multi-sensor object detector.
4.1 Experimental Setting
Datasets:
We conduct our experiments on two self-driving datasets: KITTI [18] and XENITH. XENITH collected by having fleet of self-driving cars drive around cities in North America. Snippets are captured in the daytime and detection is performed on objects within 70 meters forward and 40 meters to the left and right of the ego-car. Each vehicle frame considered separate sample and we have 12,284 vehicles in KITTI and 77,818 in XENITH.
Following prior work on object insertion attacks [12], we evaluate how often the host vehicle "disappears" by measuring its recall across various IoU thresholds. For scalar metric, we evaluate the false negative attack success rate (FN ASR) as the percentage of host vehicles detected before perturbation that are undetected after perturbation. We consider a vehicle detected if there exists an output bounding box having greater than 0.7 IoU with the vehicle. On the other hand, we consider an output bounding box a false positive if its maximum IoU with any ground truth box is less 0.3 and it does not overlap with any detection produced before perturbation. We evaluate the false positive attack success rate (FP ASR) as the percentage attacks which generate at least one false positive. Finally, the overall attack success rate (ASR) is the percentage of attacks which successfully create a false positive or false negative.
Metrics:
Implementation Details: The adversarial mesh is initialized as an icosphere with 162 ver- tices and M 320 faces. Per-face textures parameterized using texture atlas with a 5 x texture resolution for each face. During optimization, we set dla = 0.001, Ap = 1, and further con- strain the scale of the mesh with an axis-aligned 3D box where the and coordinates are bounded by L = L, = 0.8m and the 2 coordinate is bounded by L, = 0.5m. We use Adam [69] to opti- mize the mesh parameters with learning rate of 0.004 for textures and 0.001 for vertex coordinates. To target either LiDAR or image branch in isolation, we disable gradient flow to the other branch during the backward pass the adversary.
4.2 Universal Adversarial Attacks
Hiding Host Vehicle:
We evaluate the drop in recall in detecting the host vehicle, as missed de- tections can lead to colliding with unseen objects which the most dangerous outcome. We sweep IoU thresholds and visualize the loU-recall curve in Figure 3. First, inserting mesh with random-

---

Detector
Atlack
ASR
FP ASR
ASR
Delector
Atlack
FN ASR
FP ASR
ASR
LiDAR
LiDAR [12]
31.85%
4.84%
33.23%
LiDAR
LiDAR [12]
23.80%
10.70%
32.60%
Random
5.68%
2.01%
7.64%
Random
5.06%
4.15%
9.17%
LiDAR
LiDAR
7.99%
2.36%
10.11%
LiDAR + Image
LiDAR
9.52%
6.21%
15.33%
Image
Image
26.06%
3.40%
28.43%
Image
42.81%
10.78%
49.59%
Both
32.76%
4.38%
34.68%
Both
43.15%
11.77%
49.76%
Table 1:
Attacks on KITTI. Also comparing with random meshes and a LiDAR only model.
Table 2:
Attacks on XENITH. Also comparing
with random meshes and LiDAR only model.
Input Image
Irage Foatures
imae
Image Reatures
True Foative
Pourive
BEV Detections
Projected image Feacures
WFV Detections
Projected Image Features
Figure 6: Visualization of the attack producing distant false positives due to the camera's 's perspective projection, as well as the corrupted image features in the image plane and projected in 3D.
ized shape and appearance has little impact on the detector. On the other hand, an adversarial mesh generated by perturbing both input modalities leads to significant drop in recall. Moreover, we perturb the LiDAR and image inputs in isolation and find that targeting the LiDAR inputs alone yields very weak attacks. Mcanwhile, targeting the image alone is almost as strong perturbing both modalities. Therefore, image inputs are significantly less robust to the proposed attack.
Attack Success Rates: In Table I and Table 2, we further analyze results in terms of the attack success rates. Again, we consider meshes with randomly generated geometry and texture as a baseline. We observe similar trends of image features being sig- nificantly more vulnerable. In addition to missed detections, the adversarial mesh able to attack the detector through generating false positive proposals of objects that do not exist. Furthermore, we com- pare against prior work [12] which attacks LiDAR- only detector. In this case, incorporating image in- puts boosts robustness to LiDAR attacks at the cost of being more vulnerable to multimodal attacks.
Figure 5: Size of adversary box constraint vs attack success rate.
60
ASR
50-
Success Rate (%)
40-
30
20
Adversary Size Furthermore, understand how much the size of the adversary affects the strength of the attack, we vary the size of the box constraints on the vertex parameters. Here we sweep Le = Ly = Lg- = L and and measure the attack success rates. Results are shown in Figure 5, As expected, the attack becomes stronger as the fox constraints on vertex coordinates are relaxed.
0.4
0.5
0.6 (mmeters)
0.7
0.8
Qualitative Examples: Qualitative examples are shown in Figure 4. First, the detector fails to detect host vehicles with the adversarial mesh on its rooftop. We show detections in the image rather than LiDAR for ease of viewing. Note that the same adversarial mesh is used for all demonstrations, as the attack is agnostic to the host vehicle and environment. Furthermore, we show in Figure 6 that our adversarial mesh generates false positives at very distant locations. Here, detections are visualized in BEV since distant objects appear too small in the image. Additionally, we visualize image features in the image plane and the visual cone of projected image features into 3D, showing that long-range false positives are caused by strong image features dominating after fusion.
We conduct transfer attacks across datasets and show results in Table 3. Overall, our transfer attack on the target dataset is stronger than attacking only the LiDAR
Box Transfer Attacks:
7

---

Source
'Target
FN ASR
ASR
ASR
Defense
FN ASR
FP ASR
ASR
AAPelean)
KITTI
32.76%
4.38%
34.68%
None
43.15%
11.77%
49.76%
84.64%
KITTI
XENITH
14.20%
2.86%
16.88%
JPEG [70]
43.19%
9,45%
49.60%
84.52%
KITTI
12.64%
6.12%
18.22%
Adv Train [68]
7.83%
8.29%
14.97%
84, 16%
XENITH
XENITH
43.15%
11.77%
49.76%
Adv FD [36]
3.57% %
7.53%
10.82%
83.97%
Table 3: Transfer - KITTI& & XENITH
Table 4: Defense results on XENITH
input modality on the source dataset, especially from XENITH KITTI. On the other hand, the transferability is probably lowered by the image resolution and hardware, which is beyond the scope of our paper but an interesting future direction to explore.
4.3 Improving Robustness
Attacks Against Defense Methods: As empirical findings suggest that the image feature is more vulnerable, we first employ an existing image-based defense method that removes figh-freyeeccy component through JPEG compression [70]. In addition, we conduct adversarial training against the attacker. Since generating a strong adversary is extremely expensive due to the simulation pipeline, employ a strategy similar to Free Adversarial Training [68] and reuse past perturbations by con- tinuously updating the same adversarial object. Specifically, we perform updates to the adversary per one update to the model. We combine the feature denoising [36] with the adversarial training to further enhance robustness against image perturbations in particular. We report the success rates as well as the average precision (AP) at 0.7 IoU to study the trade-off between adversarial robustness and performance on benign data [35].
As shown in Table 4, we find JPEG compression is very ineffective as defense. We hypothesize this is because the input-agnostic adversary is rendered at various different poses during training and therefore do not rely high-frequency signals that are removed by JPEG compression. In comparison, our adversarial training effectively reduces the overall attack success rate from 49.76% to 14.97% while dropping AP by 0.5%. Finally, adding non-local mean blocks after every residual block in the image processing backbone further improves robustness by reducing the ASR by 5%.
While adversarial training methods are effective, they are specific to a specific threat model and may not generalize to unseen perturbations. A more threat-agnostic mechanism like more robust sensor fusion would bring more robustness in general. Furthermore, adversarial defense methods are only effective at recovering the missed detections, but struggle to detect false positives. We believe this is because distant false positives shown in Figure 6 are only partially due to vulnerabilities to adversarial perturbations. In fact, such examples exploit erroneous associations between objects that are distant in 3D. Specifically, the mapping between a mesh pixel and a LiDAR point far away from the mesh enables such attacks. These false associations can easily occur if the assigned pixel for each LiDAR points is shifted by few pixels, since objects which are far apart in 3D may appear very close in 2D. We identify two reasons how this can occur in practice. First, due to the receptive field of DNN activations, an adversarial object can influence pixels outside its physical boundaries. Second, while LiDAR sweeps are collected in continuous fashion with a rotating sensor, images are captured instantaneously at regular intervals. Consequently, the camera extrinsics used for projection become outdated for LIDAR points captured before and after the image. Thus, to achieve more robust sensor fusion for images and LiDAR, fusion modules must reason about 3D geometry, contextual information, and temporal information of LiDAR points to generate mappings between image pixels and LiDAR points more intelligently. We hope these findings will inspire future work towards more robust sensor fusion methods.
Discussions and Future Work:
5 Conclusions
Our work investigates practical adversarial attack against mulit-sensee melit--ennsr detection models in self- driving to understand how consuming multiple input modalities affect adversarial robustness. Com- pared to existing attacks against multimodal detectors, our object insertion attack is more threatening in practice as we generate input-agnostic and physically realizable adversarial perturbations. Our ex- periments reveal that vulnerabilities of multi-sensor object detectors primarily due non-robust. image features. While adversarial training can effectively recover the missed detections, we find still struggles to detect false positives without a deeper reasoning about 3D geometry in feature fusion. We believe this work would open up new research opportunities and challenges in the field of multi-sensor robustness.
8

---

References
[1] S. Gupta, R. Girshick, P. Arbelácz, and J. Malik. Learning rich features from RGB-D images for object detection and segmentation. In ECCV, 2014.
[2] S. Song and J. Xiao. Deep sliding shapes for amodal 3D object detection in RGB-D images. In CVPR, 2016.
[3] W. Wang and U. Neumann. Depth-aware CNN for RGB-D segmentation. In ECCV, 2018 8.
[4] C. R. Qi, W. Liu, C. Wu, H. Su, and L. J. Guibas. Frustum pointnets for 3D object detection from RGB-D data. In CVPR, 2018.
[5] M. Liang, B. Yang, Y. Chen, R. Hu, and R. Urtasun. Multi-task multi-sensor fusion for 3D object detection. In CVPR, 2019.
[6] B. Yang, R. Guo, M. Liang, S. Casas, and R. Urtasun. Radarnet: Exploiting radar for robust perception of dynamic objects. In ECCV, 2020.
[7] K. Eykholt, I. Evtimov, E. Fernandes.
B. Li, A. Rahmati, C. Xiao, Prakash, T. Kohno, and D. Song. Robust physical-world attacks on deep learning visual classification. In CVPR, 2018.
[8] C. Xie, J. Wang, Z. Zhang, Y. Zhou, L. Xie, and A. Yuille. Adversarial examples for semantic segmentation and object detection. ICCV, 2017.
[9] J. Lu, H. Sibai, and E. Fabry. Adversarial examples that fool detectors. arXiv preprint 1711:2171,.02494, 2017.
[10] R. Wiyatno and A. Xu. Physical adversarial textures that fool visual object tracking. In ICCV, 2019.
[11] A. Ranjan, J. Janai, A. Geiger, and M. Black. Attacking optical flow. In ICCV, 2019.
[12] Tu, M. Ren, S. Manivasagam, M. Liang, B. Yang, R. Du Cheng, and Urtasun. Physi- cally realizable adversarial examples for LiDAR object detection. In CVPR, 2020.
[13] S. Wang, T. Wu, and Y. Vorobeychik. Towards robust sensor fusion in visual perception. arXiv preprint 20l.:2006.11999 2020.
[14] Y. Cao, N. Wang, C. Xiao, D. Yang, J. Fang, R. Yang, Q. A. Chen, M. Liu, and B. Li. 3D adversarial object against msf-based perception in autonomous driving. In MLSys, 2020.
[15] A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok. Synthesizing robust adversarial examples. In ICML. PMLR, 2018.
[16] C. Xiao, D. Yang, B. Li, J. Deng, and M. Liu. Meshadv: Adversarial meshes for visual recognition. In CVPR, 2019.
[17] C. Xiang, C. R. Qi, and B. Li. Generating 3D adversarial point clouds. In 2019,
[18] A. Geiger, P. Lenz, and R. Urtasun. Are ready for autonomous driving? the KITTI vision benchmark suite. In Conference on Computer Vision and Pattern Recognition (CVPR), 2012.
[19] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. ICLR, 2014.
[20] J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. ICLR, 2015.
[21] S.TT. Chen, C. Corneluu,, J. Martin, and D. H. Chau. Shapeshifter: Robust physical ad- versarial attack on Faster R-CNN object detector. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, 2018.
[22] X. Liu, H. Yang, Z. Liu, L. Song, H. Li, and Y. Chen. Dpatch: An adversarial patch attack on object detectors. arXiv preprint arXiv: 01061882660999 2018.

---

[23] Y. Li, D. Tian, M.-C. Chang, X. Bian, and S. Lyu. Robust adversarial perturbation on deep proposal-based models. arXiv preprint arXiv:1809.05963 2018.
[24] X. Wei, S. Liang, N. Chen, and X. Cao. Transferable adversarial attacks for image and video object detection. In IJCAI, 2019.
[25] S. Moosavi-Dezfooli, A. Fawzi, and P. Frossard. Deepfool: simple and accurate method to fool deep neural networks. In CVPR, 2016.
[26] S. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard. Universal adversarial perturbations. In CVPR, 2017.
[27] N. Papernot, P. D. McDaniel, I. J. Goodfellow, S. Jha, Z. B. Celik, and A. Swami. Practical black-box attacks against machine learning. In R. Karri, O. Sinanoglu, A. Sadeghi, and X. Yi, editors, AsiaCCS, 2017.
[28] W. Brendel, J. Rauber, and M. Bethge. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In ICLR. OpenReview.net, 2018.
[29] H. Li, X. Xu, X. Zhang, S. Yang, and B. Li. QEBA: query-efficiint boundary- based blackbox attack. In CVPR, 2020.
[30] A. Athalye, N. Carlini, and D. Wagner. Obfuscated gradients give false sense of security: Cireumventing defenses adversarial examples. arXiv preprint arXiv:1802.00420, 2018.
[31] N. Papernot, P. McDaniel, S. Jha, M. Fredríkson, Z. B. Celik, and A. Swami. The limitations of deep learning in adversarial settings. In EuroS&P, 2016.
[32] N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In SP, 2017.
[33] A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B. Tran, and A. Madry. Adversarial examples not bugs, they are features. In NeurlPS, 2019.
[34] N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfel- low, A. Madry, and A. Kurakin. On evaluating adversarial robustness. arXiv preprint vrXiv:1902.06705, 2019.
[35] D. Tsipras, S. Santurkar, I.. Engstrom, A. Tumner, and A. Madry. Robustness may be at odds with accuracy. arXiv preprint 18Xiv: 12152 2018.
[36] C. Xie, Wu, L. v. d. Maaten, A. L. Yuille, and K. He. Feature denoising for improving adversarial robustness. In CVPR, 2019.
[37] L. Engstrom, B. Tran, D. Tsipras, L. Schmidt, and A. Madry. Exploring the landscape of spatial robustness. In ICML, 2019.
[38] T. B. Brown, D. Mané, A. Roy, M. Abadi, and J. Gilmer. Adversarial patch. arXiv preprint arXiv:1712.00665,, 2017.
[39] C. Yang, A. Kortylewski, Xie, Y. Cao, and A. Yuille. Patchattack: A black-box basture-based attack with reinforcement learning. In ECCV, 2020.
[40] A. Hamdi, M. Müller, and B. Ghanem. Sada: semantic adversarial diagnostic attacks for autonomous applications. In Proceedings of the AAAI Conference Artificial Intelligence, volume 34, pages 10901-10908, 2020.
[41] J. Li, F. R. Schmidt, and J. Z. Kolter. Adversarial camera stickers: A physical camera-based attack on deep learning systems. K. Chaudhuri and R. Salakhutdinov, editors, ICML, 2019.
[42] H. Kato, D. Beker, M. Morariu, T. Ando, T. Matsuoka, W. Kehl, and A. Gaidon. Differentiable rendering: A survey. CORR, abs/2006.1 12057, 2020.
[43] X. Zeng, C. Liu, Y.S. Wang, W. Qiu, L. Xie, Y.-W. Tai, C.-K. Tang, and L. Yuille. Adver- sarial attacks beyond the image space. In CVPR, 2019.
10

---

[44] Y. Zhang, H. Foroosh, P. David, and B. Gong. CAMOU: learning physical vehicle camouflages adversarially attack detectors in the wild. In ICLR, 2019.
[45] R. Duan, X. Ma, Y. Wang, J. Bailey, A. K. Qin, and Y. Yang. Adversarial camouflage: Hiding physical-wordd world attacks with natural styles. In CVPR, 2020.
[46] L. Huang, C. Gao, Y. Zhou, C. Xie, L. Yuille, C. Zou, and N. Liu. Universal physical camouflage attacks on object detectors. In CVPR, 2020.
[47] T. Chen, Y. Wang. J. Zhou, S. Liu, S. Chang, C. Bajaj, and Z. Wang. Can 3D adversarial logos cloak humans? CoRR, abs/2006. 14655, 2020.
[48] Z. Wu, S.-N. Lim, L. S. Davis, and T. Goldstein. Making an invisibility cloak: Real world adversarial attacks on object detectors. In European Conference Computer Vision, pages 1-17. Springer, 2020.
[49] A. Hamdi, S. Rojas, A. K. Thabet, and B. Ghanem. AdvPC: Transferable adversarial pertur- bations on 3D point clouds. In A. Vedaldi, H. Bischof, T. Brox, and J. Frahm, editors, ECCV, 2020.
[50] J. Yang, Q. Zhang. R. Fang, B. Ni, J. Liu, and Q. Tian. Adversarial attack and defense point sets. CoRR, abs//992... 10899, 2019.
[51] A. Hamdi, S. Rojas, A. Thabet, and B. Ghanem. Adype: Transferable adversarial perturbations on 3D point clouds. In ECCV, 2020.
[52] Y. Cao, C. Xiao, B. Cyr, Y. Zhou, W. Park, Rampazzi, Q. A. Chen, K. Fu, and Z. M. Mao. Adversarial sensor attack on LiDAR-based perception in autonomous driving. In L. Cavallaro, Kinder, X. Wang, and J. Katz, editors, CCS, 2019.
[53] J. Sun, Y. Cao, Q. A. Chen, and Z. M. Mao. Towards robust LiDAR-based perception in autonomous driving: General black-box adversarial sensor attack and countermeasures. In S. Capkun and F. Roesner, editors, USENIX Security, 2020.
[54] Y. Cao, C. Xiao, D. Yang, J. Fang, R. Yang. M. Liu, and B. Li. Adversarial objects against LiDAR-based autonomous driving systems. arXiv preprint arXiv:/907.05444 2019.
[55] M. Liang B. Yang, Wang, and R. Urtasun. Deep continuous fusion for multi-sensor 3D object detection. In ECCV, 2018.
[56] V. A. Sindagi, Y. Zhou, and O. Tuzel. MVX-Net: Multimodal voxelnet for 3D object detection. In ICRA, 2019.
[57] S. Fadadu, S. Pandey, D. Hegde, Y. Shi, F.-C. Chou, N. Djuric, and C. Vallespi- Multi-view fusion of sensor data for improved perception and prediction autonomous driv- ing. In CoRL, 2020.
[58] M. Bijelic, T. Gruber, F. Mannan, F. Kraus, W. Ritter, K. Dietmayer, and F. Heide. Seeing through fog without seeing fog: Deep multimodal sensor fusion in unseen adverse weather. In CVPR, 2020.
[59] S. Chadwick, W. Maddetn, and P. Newman, Distant vehicle detection using radar and vision. In ICRA, 2019.
[60] Y. Yu, J. Lee, B. C. Kim, J. U. Kim, and M. Ro. Investigating vulnerability to adversarial examples on multimodal data fusion deep learning. CoRR, abs/2005. 10987, 2020. URL https: //wpvv.//vvv//v/////v///ae//aavv
[61] Engelmann, J. Stückler, and B. Leibe. SAMP: shape and motion priors for 4D vehicle reconstruction. In WACV, 2017.
[62] M. Najibi, G. Lai, A. Kundu, Z. Lu, V. Rathod, T. Funkhouser, C. Pantofaru, D. Ross, L. S. Davis, and A. Fathi. DOPS: Learning to detect 3D objects and predict their 3D shapes. In CVPR, 2020.

---

[63] W. E. Lorensen and H. E. Cline. Marching cubes: A high resolution 3d surface construction algorithm. ACM siggraph computer graphics, 1987.
[64] Möller and B. Trumbore. Fast, minimum storage ray-triangle intersection. Journal of graph- ics tools, 1997.
[65] S. Liu, T. Li, W. Chen, and H. Li. Soft rasterizer: A differentiable renderer for image-based 3D reasoning. In ICCV, 2019.
[66] Y. Chen, B. Yang, M. Liang, and R. Urtasun. Learning joint 2D)-3D) representations for depth completion. In ICCV, 2019.
[67] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning mod- els resistant to adversarial attacks. In International Conference on Learning Representations, 2018. URL https: / http//ppeereveeeeeeeeeeeeeeeeeee ew. net/ fo d=
[68] A. Shafahi, M. Najibi, M. A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. Davis, G. Taylor, and T. Goldstein. Adversarial training for free! In NeurIPS, 2019.
[69] D. P. Kingma and J. Ba. Adam: A method for stochastic optimization. arXiv preprint 1412v:1412.6988) 2014.
[70] G. K. Dziugaite, Z. Ghahramani, and D. M. Roy. A study of the effect of JPG compression on adversarial images, arXiv preprint arXiv: 1608 00853, 2016.
12


Reviews:
[{"review_id": "zvP-zJnUyD6", "reviewer": "Reviewer_2uDN", "summary": "The paper presents a framework for having multi-modal adversarial attacks in self-driving domain, and uses both pixel images and LiDAR attacks. The authors perform extensive experiments grounded in practical self-driving settings, and proposes consistent perturbations among the input modalities. ", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\nThe paper made a clear contribution to the study of multi-modal adversarial attacks in self-driving domain. The design of the experiments are technically sound, and the authors gave a clear and extensive literature review of the prior works and introduced the method in this paper pretty well. \n\nWeaknesses (or some thoughts upon the paper):\n\nOne thought I'm having is whether it's worth considering more subtle adversarial attacks on top of the adversarial mesh. For example, in image classification adversarial attacks work there has been minor changes on road signs, changing colors of certain parts of the images etc that are semantically meaningful to human's discretion. I wonder if the same thing could be done to the images and LiDAR inputs in the self-driving setting.\n\nAlso, is it possible to have some qualitative analysis of the result of detecting adversarial attacks? For example, it could show some success / failure examples of different methods and therefore shows how this method outperform the previous ones in a qualitative way.\n\nOne other minor point is potentially some implementation details could go into the appendix, and the main paper could be spent on more discussion / analysis. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "I recommend the paper for acceptance as multi-modal adversarial attacks is an interesting yer understudied problem in self-driving domain, and the authors has demonstrated success in attacks in multi-model inputs. ", "technical_quality": "Very Good:  Convincing.", "clarity_of_presentation": "Very Good:  Well organized and clear.", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"impact": "4: The work contains interesting new ideas that will potentially have major impact in robotics or machine learning.", "issues": "It would be great if the authors could respond to some of the concerns listed in the Strengths and Weaknesses section. ", "reviewer_expertise": "Fair: Some knowledge of the area"}, "extra_text": {}}, {"review_id": "SR5TTu7tQl3", "reviewer": "Reviewer_4ZtU", "summary": "This paper addresses the problem of assessing the robustness of\nmulti-sensor neural networks, as used in robotic applications. The\nauthors develop a physical-like attack (by simulating an object on the\nvehicle in front) such that the attack affects both measurement\nmodalities (namely, images and lidar) in a consistent way. The authors\nprovide an evaluation over two datasets, which suggests that using\nmulti-sensor networks does improve robustness to individual-sensor\nattacks but may be susceptible to multi-sensor attacks.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The paper is well written, and the approach is clear. I like the idea\nof using sensor fusion to improve robustness to adversarial attacks.\n\nMy first comment has to do with the paper's contribution. The authors\nclaim that their main contribution is developing an attack that is\nconsistent across different sensor modalities. However, no\nquantitative evaluation of the proposed attack generation is\nprovided. How can one tell (quantitatively) that the proposed attack\nis physically consistent across sensors? A real-world example(s) would\nalso help demonstrate that this attack choice is valid.\n\nMy second comment is that I think the sensor fusion aspect is not\nsufficiently explored. In particular, it seems that the utilized\nsensor fusion method is putting too much weight on the image\nprocessing part, which is why even image attacks on their own are\nquite successful. Instead of retraining the detectors using\nadversarial training, I think that coming up with a better sensor\nfusion approach would bring more robustness in general. The reason for\nthis is that adversarial training is performed for the specific attack\nimplemented in this paper. On the other hand, a robust sensor fusion\napproach would make sure that the physical attack needs to be very\nprecisely coordinated in order to modify the various sensor modalities\nin an adversarial way.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "Overall, I think that using sensor fusion to improve robustness is a promising research direction and should be explored further. Although I think the paper could provide better sensor fusion analysis, I think it is a good first step in this field.", "technical_quality": "Fair: Significant additional evidence required to support the claims.", "clarity_of_presentation": "Very Good:  Well organized and clear.", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"impact": "3: The work is incremental and unlikely to have much impact, even though it may be technically correct and well executed.", "issues": "N/A", "reviewer_expertise": "Excellent: Expert knowledge on the topic of the paper"}, "extra_text": {}}, {"review_id": "R86QzqYVmK4", "reviewer": "Reviewer_2ySC", "summary": "This paper presents an adversarial perturbation method to multi-modal inputs (e.g., LIDAR point cloud & image) showcase the susceptibilities of multi-sensor object detection systems on self-driving cars. Different from existing works that only investigate proof-of-concept adversarial methods on image data via perturbation with imperceptible noises (whose physical realizability is questionable),  the presented method focuses on physically realizable attacks via (adversarial) object insertion. In this approach, the adversary is represented via a parametrized texture mesh, which can be optimized and rendered into an object to be mounted on top of self-driving cars.\n\nThis is achieved by inserting the mesh into the LIDAR point cloud and project it onto the original 2D image, from which pixel depths can be estimated via an off-the-shelf depth estimation algorithm. These results in parameterized LIDAR & image modifications (their defining parameters are those of the texture mesh) which can be optimized to maximize the rate of false positive & false negative over the detection algorithm's bounding box proposal. The optimized texture mesh is then treated as an input-agnostic adversary that can be inserted in any (test) images & corresponding LIDAR point cloud. The effectiveness of the proposed method is also studied empirically in a transfer setting where it is computed on one dataset (e.g., KITTI) but applied & tested on another (e.g., XENITH). All reported results show promising & interesting results. ", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "STRENGTH:\n\nThe method is well-motivated from a very practical angle. Instead of simply demonstrating a proof-of-concept via crafting imperceptible noises to perturbs images adversarially (which might not be realizable physically), the proposed method studies a new method that aims to render a physical object with adversarial texture that can be naturally inserted into the scene to perturb both the LIDAR & image input to the object detection system on self-driving car.\n\nThe paper is very well-written & the experiments are also well-presented, which sufficiently demonstrate the effectiveness of the proposed method.\n\nFrom the proposed attack, an adversarial training algorithm is also presented which helps decrease the success rate of the attack, thus making this a completed & motivating research.\n\nWEAKNESSES:\n\nI noticed that the trade-off coefficient of the Laplacian regulariser is rather small in the experiment, which apparently makes the size of the mesh relatively large (as shown in many visual excerpts). This unfortunately makes the adversary less realistic & realizable -- while the attack is effective, the perturbed images do not look natural at all.\n\nCould the authors elaborate more on the effectiveness of the method with varying size of the texture mesh? In addition, I think it would also be important to compare with image-based attack methods (e.g., simply put a sticker on the host vehicle rather than mount a 3D object on top of it) to highlight the advantage of being able to create an attack on multiple sensor modalities.\n\nFurthermore, the attack method has been evaluated against specific-defense methods but it remains unclear how effective it is against black-box defense methods? It would be great if the authors could comment on whether such experiment is possible?\n\nAnother (more minor) point: For thoroughness, please consider running the evaluation on multiple, independent data split to report the confidence of the success rate estimation. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "In general, I like the proposed idea, especially its practical angle on a physically realizable attack via natural object insertion. That being said, I feel that the evaluation here is still pretty much artificial at this point but I acknowledge that this is an interesting concept that might inspire more follow-up investigations. Given this, my rating for this work is weak accept. ", "technical_quality": "Good: Generally convincing, but some additional experiments or analyses needed.", "clarity_of_presentation": "Very Good:  Well organized and clear.", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"impact": "4: The work contains interesting new ideas that will potentially have major impact in robotics or machine learning.", "issues": "Please refer to my specific comments & questions in the weakness section above. ", "reviewer_expertise": "Good: General knowledge of the area"}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper investigates the problem of adversarial robustness of multi-sensor perception systems, with a focus on the autonomous driving domain. While the reviewers are generally positive about this paper, they also raise a number of important concerns. The authors should carefully address the reviewers' comments in their rebuttal. 

UPDATE POST DISCUSSION PHASE: I would like to thank the authors for their comments and clarifications during the discussion phase. The reviewers agree that this paper provides a valuable contribution, and I concur with this assessment.
Decision: Accept (Poster)