On the Adversarial Robustness of Camera-based 3D Object Detection
Authors: Shaoyuan Xie
Zichao Li
Zeyu Wang
Cihang Xie
Venue: Accepted by TMLR ()

Abstract: In recent years, camera-based 3D object detection has gained widespread attention for its ability to achieve high performance with low computational cost. However, the robustness of these methods to adversarial attacks has not been thoroughly examined, especially when considering their deployment in safety-critical domains like autonomous driving. In this study, we conduct the first comprehensive investigation of the robustness of leading camera-based 3D object detection approaches under various adversarial conditions. We systematically analyze the resilience of these models under two attack settings: white-box and black-box; focusing on two primary objectives: classification and localization. Additionally, we delve into two types of adversarial attack techniques: pixel-based and patch-based. Our experiments yield four interesting findings: (a) bird's-eye-view-based representations exhibit stronger robustness against localization attacks; (b) depth-estimation-free approaches have the potential to show stronger robustness; (c) accurate depth estimation effectively improves robustness for depth-estimation-based methods; (d) incorporating multi-frame benign inputs can effectively mitigate adversarial attacks. We hope our findings can steer the development of future camera-based object detection models with enhanced adversarial robustness. The code is available at: https://github.com/Daniel-xsy/BEV-Attack.

Published in Transactions on Machine Learning Research (01/2024)
On the Adversarial Robustness of Camera-based 3D Object Detection
Shaoyuan Xie
shooyur@ruii.dd edu
Deportment of Computer Science University of California, Irvine
Zichao Li
2l84890uucsc.oo
Department Computer Science and Engineering University of California, Santo. Cruz
Zeyu Wang
zwang615@uccs edu
Department of Computer Science and Engineering University of California, Santa Crus
Cihang Xie
cinie edu
Department of Computer Science and Engineering Universily of California, Santa Cruz
Reviewed on OpenReview: https: // openreview. net/ formm? id= fFl Fu
Abstract
In recent years, camera-based 3D object detection has gained widespread attention for its ability achieve high performance with low computational cost. However, the robust- ness of these methods to adversarial attacks has not been thoroughly examined, especially when considering their deployment in safety-critical domains like autonomous driving. In this study, we conduct. the first comprehensive investigation of the robustness of leading camera-based 3D object detection approaches under various adversarial conditions. We sys- lematically analyze the resilience of these models under two allack settings: white-box and black- box; focusing on two primary objectives: classification and localization. Additionally, we delve into two types of adversarial attack techniques: pixel-based and patch-based. Our experiments yield four interesting findings: (a) bird' --eee---eeww-aeeed representations exhibit stronger robustness against localization attacks; (b) depih-estimatioon-ree approaches have the potential to show stronger robustness; (c) accurate depth estimation effectively improves robustness for depth-ostimation based methods; (d) incorporating multi-frame benign inputs can effectively mitigale ad adversarial altacks. We hope our findings can steer the development of future camera- based object detection models with enhanced adversarial robustness. The www.ttuuw.ooo.aaeeaeeeeee...eee.
code is available at:
Attack
1
Introduction
Deep neural baseork-based 3D object detectors Li et al. 2022b Wang et al. 2022b Huang al. 2021
Liu et al.) 2022a Wang et al. 2022a 2021 Lang al. 2019 Vora et al. 2020 Zhou & Tuzel 2018 Yan
ct al.
2018) have demonstrated promising performance across multiple challenging real-world benchmarke ks.
including the KITTI (Geiger et. al. 2012),
nuScenes (Caesar el al. 2020) and Waymo Open Datasel (Sun 2020). These popular approaches utilize either point clouds (i.e., LiDAR-based methods) (Lang et al.
et al.
2019
Vora ct al. 2020 Zhou & Tuzel
2018 Yan al. 2018 or images (i.e., camera-basod methods) (Wang
et al.
Huang et al. 2021 Liu al. 2022a) as their inputs for object de- tection. Compared to HIDAR-based methods, camera- based approaches have garnered significant. attention
2021] 2022a Li al.
2022b

---

Published in Transactions on Machine Learning Research (01/202))
Adversarial nuScenes Detection Score
BEVFormerSmaill
BEVFormer-Small-an
BEVFormer-ase
BEVeomer-Bse-TTmp
DETR3D
DETR3D
0.18
FCOS3D
PGD
BEVDepth-R50
BEVDepth4D-R50
0.16
BEVDepth-R101
BEVDet-R50
BEVDet-R1O
Swinet-Swin-Tiny
BEVDet4D-R50
PETR-R50
PETR-Vov
0.12
0.35
0.50
nuScenes Detection Score
Figure Adversarial nuScenes Detection Score (NDS) v.s. clean nuScenes Detection Score. Models that exhibit better performance on standard datasets do not necessarily exhibit better adversarial robustness.
due to their low deployment cost, high computational efficiency, and dense semantic information. Addition- ally, casera-based detection cxhibits inherent advantages in detecting long-range objects and identifying vision-based traffic signs.
Monocular 3D object detection expands the capabilities of 2D object detection to 3D scenarios using carefully designed custom adaptations (Wang et al. 2021 2022a). However, accurately estimating depth from single image challenging, often hindering the efficacy of monocular 3D object detection (Wang et. al. 2022a In contrast, using the bird's eye view (BEV) representation for 3D detection offers several advantages. First, allows for joint learning from multi-view images. Second, the BEV perspective provides a physics- interpretable method for fussigg information from different sensors and time stamps (Ma al. 2022). Third, the output space of BEV-based approach be easily applied to downstream tasks such prediction and planning. Consequently, BEV-based models have demonstrated significant improvements Li ct al. 2022a
Huang et al. 2021 Huang & Huang 2022
Despite the advancements achieved in 3D object detection algorithms, recent literature (Rossolini et al. 2022 Cao et al.) 2021 Tu et al. 2020) have begun to highlight their susceptibility to adversarial attacks. Such vulnerabilities pose significant safety risks, particularly when these algorithms are deployed in safety- critical applications. Nevertheless, existing studies primarily concentrate on generating adversarial examples in limited scenarios, thereby failing to provide comprehensive evaluation across broader spectrum of adversarial settings and models. Motivated by this gap in the literature, aim to conduct thorough and systematic analysis of the robustness of various state-of-the-art 3D object detection methods against adversarial attacks, while also investigating avenues to bolster their resilience.
Our investigation includes a spectrum attack settings: pixel-based (introducing subtle perturbations inputs) and patch-based (overlaying discernible adversarial designs onto inputs) adversarial examples, white-box and black-box (whether information about the model available to the attacker) setups. Our focus is on two main attack goals: misleading classification predictions and misleading localization predictions. Regarding pixel attacks, apply the widely-used projected gradient descent (PGD) algorithm (Madry et al. 2017p. To differentiate this attack algorithm from the 3D dctection method known Probabilistic and Geometric Depth (Wang el al.) (002a),, we refer to the former as PGD-Ade and the latter as PGD- Det in the rest of the paper. To further enhance the comprehensiveness of our work, we additionally use FGSM (Goodfellow et al.) (2044), C&W Attack (Carlini & Wagner 2017] and AutoPGD Attack (Croce patch (Brown et al., 2017 centrally onto the target objects, adjusting its size accordingly with the object size. Additionally, we
Hein 2020). Regarding patch attacks, we incorporate a pradient-descent-onn
2

---

Published in Transactions on Machine Learning Research (01/2024)
probe the efficacy of universal patches, known for their strong transferability across varied scenes, scales, and model architectures. Overall, our experiments interestingly show that models that perform better on standard datasets do not necessarily yield stronger adversarial robustness, as shown in Fig. I We distill our koy findings as follows:
BEV-based models do not exhibit stronger robustness under classification attacks. However, they tend to be more robust toward localization attacks.
Precise depth estimation is crucial for models that rely on depth information to transform the perspective view to the bird's eye view (PV2BEV). The incorporation of explicit depth supervision during training, as well as prior knowledge of depth constraints, can lead to improved performance and stronger robustness.
Depthaistimation free methods have achieved state-of-thar torth-rrr performance with clean inputs (Wang ct al. 2022b Li et al., 2022b Liu et al.] (022a), we further find they have the potential yield stronger robustness compared to depth--stiimation-ban
ones.
Adversarial effects can be mitigated through clean temporal information. Models utilizing multi- frame benign inputs are less likely to fail under single-frame attacks. However, it is important note that errors can accumulate under continuous adversarial input over multiple frames.
2 Related Work
Camera-based 3D object detection. Existing camera-based 3D object detection methods can be broadly
categorized into two groups: monocular-based approaches (Wang et al.
2021 2022a) and multi-view image
input bird's eye view (BEV) representation- based approaches (Li et al.
b022b;
Huang et al. 2021 Huang
& Huang 2022: Li al. 2022a Wang et al. 2022b Liu al.]
2022a
Monocular-bard
approaches, such
FCOS3D and PGD-Det (Wang et al.) 2021 2022a extend FCOS
TTan et al., 2019) to the 3D domain
through specific adaptations. BEV-based detectors perform PV2BEV and build BEV representations to
conduct perception lasks. Inspired by LSS (Philion & Fidler 2020 BEVDet (Huang et al.,
2021] uses an
additional depth estimation branch for the PV2BEV transformation. BEVDet4D (Huang & Huang 2022)
further improves performance by leveraging temporal information. BEVDepth (Li et al. 2022a improves depth estimation accuracy through explicit depth supervision from point clouds.
Given that inaccurate depth estimation is the main bottleneck of the above approaches, recent works explore pipelines without explicit depth estimation branch. DETR3D (Wang et al. 2022b) represents 3D objects object queries and performs cross-attentil using Transformer decoder (Vaswani et al. 2017). PETR Liu ct al. [Li et al. 2022b) introduces temporal cross-attention to extract BEV representations from multi-timestamp images. While these models show consistent improvement on the standard dataset, their behaviors under adversarial attacks have not been thoroughly examined, which could raise profound concerns, especially considering their potential deployment safety-critical applications, e.g., autonomous driving.
2022a bb further improves performance by proposing 3D position-aware representations BEVFormer
Adversarial attacks on classification. Modern neural networks are susceptible to adversarial attacks (Szegedy et al. 2013 Goodfellow et al. 2014 Moosavi-Dezfooli et al. 2017), where the addition of a carefully crafted perturbation to the input can cause the network to make an incorrect prediction. (Goodfellow et al. 2014) proposes a simple and efficient method for generating adversarial examples using one-step gradient descent. (Madry et al. 2017) proposes more powerful attacks (i.e., PGD-Adv) by taking multiple steps along the gradients and projecting the perturbation back onto Lp norm ball. Dezooovi-Dezfooli et al., 2017 demonstrates the existence of universal adversarial perturbations. (Brown et al.) 2017) generates physical adversarial patches. (Wu et al.] 2021) addresses adversarial robustness in the context of long- tailed distribution recognition lasks. In addition to developing more powerful attacks, some works focus on understanding the robustness different neural architecture designs to attacks. (Shao et al., 2021 Bai ct al.] 2021) conduct extensive comparisons between CNNs and Transformers and gain insights into their adversarial robustness. Different from these works which focus on classification problems, our research pivots to the detection tasks.
3

---

Published in Transactions on Machine Learning Research (01/2024)
Adversarial attacks object detection. Adversarial attacks for object detection target both lo- calization and classification. In the context of 2D object detection, (Xie et al. 2017) generates adversarial examples with strong transferability by considering all targets densely. (Liu et al. 2018) propose black- box patch attacks that can compromise the performance of popular frameworks such as Faster R-CNN (Ren vital to study the adversarial robustness of 3D object detection. (Tu et al.) 2020) crafts adversarial mesh placed on top of a vehicle to bypass & LiDAR detector. (Rossolini al.) (022) studies digital, simulated, and physical patches to mislead real-time semantic segmentatiin models. (Cao et al. 2021 reveals the possibility of crashing Multi-Sensor Fusion (MSF) based models by attacking all fusion sources simultaneously. Despite the above works toward designing more powerful attacks, there still lacks a comprehensive understanding of the adversarial robust- ness of camera-based 3D object detection. Though concurrent work (Zhu et al., 2023) also explores the adversarial robustness of 3D detectors, they study much fewer models. Our research represents a pioneering effort to systematically bridge this knowledge gap.
et al. 2015). Given the importance of safety in autonomous driving,
3 Casera-based 3D Object Detection
In this section, we provide an overview of the current leading approaches in camera-based 3D object detection, which can be broadly classified into three categories: monocular-based detectors, BEV detectors with depth estimation, and BEV detectors without depth estimation.
3.1 Monocular Approach
This line of research aims to directly predict 3D targets from an image input. We select FCOS3D (Wang
et al. 2021) and PGD-Det (Wang et al. 2022a as representative works to study their adversarial robustness. FCOS3D extends FCOS (Tian et al. 2019) to the 3D domain by transforming 3D targets to the image domain. PGD-Det further improves the performance of FCOS3D by incorporating uncertainty modeling and constructing depth propagation graph that leverages the interdependence between instances.
3.2 BEV Detector with Depth Estimation
This line of work first predicts a per-pixel depth map, mapping image features to corresponding 3D locations, and subsequently predicts 3D targets in the BEV representations. Building the success of the BEV paradigm in semantic segmentation, BEVDet (Huang et al., 2021 develops the first perf-peeformance BEV detector based on the Lift-Splat-Shoot (LSS) view transformer (Philion & Fidler 2020). Subsequently, BEVDet4D (Huang & Huang. 2022) introduces multi-frame fusion to improve the effectiveness of temporal cue learning. BEVDepth (Li et al. 2022a) proposes to use point cloud projection to the image plane for direct supervision to depth estimation. Note that this approach can also incorporate temporal fusion, which refer to BEVDepth4D. We hereby aim to evaluate the robustness of these BEV models, ranging from the most basic detector (i.e., BEVDet) to spatial (Depth) and temporal (4D) extensions, against attacks.
3.3 BEV Detector without Depth Estimation
In this set of works, trainable sparse object queries are utilized to aggregate image features without the need for depth estimation. Representative exemplars include DETR3D (Wang et al. 2022b which connects
2D feature extraction and 3D bounding box prediction through backward geometric projection; PETR {Liu eet al. 2022a b), which enhances 2D features with 3D position-aware representations: and BEVFormer (Li let al. 2022b), which refines BEV queries using spatial and temporal cross-attention mechanisms. These approaches claim to not suffer from inaccurate depth estimation intermediate and thus achieve superior performance, Our research takes step further, probing the robustness of these approaches when subjected to adversarial attacks.
4

---

Published in Transactions on Machine Learning Research (01/2024)
4 Generating Adversarial Examples
In this section, we present our adversarial example generation algorithms. is essential to note that this paper primarily focuses on understanding model robustness to attacks, rather than on the development of new attack algorithms. As such, our approach adapts established 2D adversarial attacks (Xie al. 2017
Mossavi-Deztooli et al., 2017 Madry et al.) 2017; Goodfellow et al.] 2014 Carlini & WWagner 2017 Croce & ensure compatibility. Specifically, WC consider three attack settings: pixel-based white-box attacks (Madry et al. 2017 Xie ct al. 2017). patch- based white-box attacks (Liu et al.) 2018), and universal patch black-box attacks (Moosavi-Dezfool et al. 2017j. In the context of pixel-bases and patch-based white- box attacks, we utilize two adversarial targets, namely untargeted classification attacks, and localization attacks. For patch-based black-box attacks, we
Hein 2020 for the 3D context, incorporating essential modifications
focus solely on the targeted classification. The summary of these attacks presented in Tab. 1
Table 1: A summary of the five different attack settings implemented to examine the model robustness.
White-box Black-box
Pixel / Patch
Objective
Whito-box
Pixel
Untargeted Classification
White-box
Pixel
Localization
White-box
Patch
Untargeted Classification
White-bux
Patch
Localization
Black-box
Patch
Targeted Classificatin
4.1 Pixel-based Attack
Inspired by the approach in Xic et al. 2017), we optimize the generation of adversarial examples over a set of targets. Let E Rx be an input image, comprising N largets given by T (41, l2, 43. IN By feeding the image I into 3D object detectors, we can have n perception results, capturing class, 3D bounding boxes, and other attributes, represented as f(I) = {yı, y2. "s.....,,)). Here, cach ys symbolizes a discrete detection altribute such as localization, class, velocity, edc. We then compare these predictions with the ground truth bounding boxes T, establishing match when the 2D center distances the ground plane are under predefined threshold, as employed in (Caesar et al. 2020). The goal of adversarial examples is to intentionally produce erroneous predictions. For instance, in classification attacks, the objective is to manipulate the model into predicting an incorrect class, denoted as sets + r, 42) & 4,, where (e 44) signifies the classification results on the i-th target, 4 represents its ground-trutt classification label, and r denotes the adversarial perturbation. To accomplish this, we employ untargeted allacks, aiming to maximize the cross-entree conss-entrppy loss:
N C
1 N
Luntargeted
t.)
(1)
where C' denotes the number of classes, and Si denotes the confidence score on j-th class. The adversarial perturbation is optimized iteratively using PGD-Adv (Madry et al. 2017) as:
r++1 = Proj. (r. + asgn(Vitr,.4) ()),.
(2)
To facilitate an equitable comparison, the confidence scores undergo normalization within the range [0, 1]
by using the sigmoid function, which mitigates sensitivity to unbounded logit ranges (Wu et al., 2021) Maximizing Luntargeted can be achieved by making every target incorrectly predicted. For targeted attacks, we instead specify an adversarial label i1 + 4 for each larget and minimize the following objective:
N
Ltargeted =
fu I + r, t.) fl. (I +r
(3)
N
1m1
5

---

Published in Transactions on Machine Learning Research (01/2024)
Figure 2: Illustration of adversarial patch size adaptations, wherein the patch size is adjusted proportionally to the target's 's 2D bounding box dimensions. The left panel depicts fixed-size patch, while the right panel presents dynamically scaled patch.
To attack the localization ion and other attributes, we adopt the straightforward L loss as the objective function, finding this method adequately effective:
N [[ (I+ - localli + IIoorie +I+ oriealla + 1l (I+,, +r,4) velilli- (4)
Lloentization
N
We further enhance our analysis by incorporating FGSM (Goodfellow et al., 2014). C&W Attack (Carlini & Wagner, 2017), and a stronger attacking method, AutoAttack (Croce & Hein 2020). AutaAt was originally designed for image classification tasks and can't be applied to object detection tasks directly. Therefore, we employ AutoPGD, component of AutoAttack, implementation rigorously adheres to the configurations specified in the foundational AutoAttack paper. The enhancements we introduce to the AutoPGD attack compared with the original PGD-Adv include the following modifications: (a) Integration of momentum during the update process, with the momentum. (b) Introduction of a dynamic step size that adjusts in accordance with the optimization process. (c) Implementation of a restart mechanism from the most effective attack points. (d) Balancing exploration and exploitation through the utilization of checkpoints.
more potent allack strategy- Our
Note that implementing pixel-based attacks in real-world scenarios is challenging because it requires altering camera-captured images in real-time. However, considering this type of attack is still crucial, particularly when attackers possess full knowledge of the model and can engage with real-time systems. Moreover, we can glean insights into the robustness of 3D object detectors in this adversarial setting.
4.2 Patch-based Attack
Following (Liu et al. 2018 Rossolini et al. 2022), we next turn our attention to patch-based adversarial attacks. Considering a target within a 3D bounding box, it can be characterized by its eight vertices and a central point, collectively denoted as {Co, Ci,..., C3) with o E R3. Leveraging the camera parameters, we project these 3D points to 2D points on the image plane, yielding the transformed set cc., We set the size of the adversarial patch to be proportional to the size of the rectangle formed by these 2D points, and strategically position it to be centered al point c as illustrated in Fig. 2 Nole that the adversarial loss objectives for the patch-based attack remain consistent with those detailed in Sec. 4.1
4.3 Black-box Attack
Building the concept of universal adversarial perturbations in classification tasks, extensively explored by (Moosavi-Dezfooll et al. 2017), we delve into the potential existence of universal adversarial patches specific to 3D object delection lasks. We start by defining and randomly initializing a fixed-size patch, which is then superimposed at the center of the object, as described in Sec. [.2] We employ bilinear interpolation to resize this patch. During the training phasc, we optimize the universal patch over a wide range of images using the Adam optimizer (Kingma Ba (0144), following the recommendations of MMoosavi-Dezfol et al. 2017). In the testing phase, we apply the generated patch to unseen images and evaluate its performance
6

---

Published in Transactions on Machine Learning Research (01/2024)
Table 2: Overall results: Clean results are evaluated on nuScenes validation set, and adversarial results are evaluated on the mini subset. The adversarial NDS is averaged for all the attack types and severities. f: trained with CBGS Zhu et al. (211 S re-trained models with minimal modification since there is no
publicly available checkpoint. BEV: BEV-based representations. Depth: Explicit depth estimation.
Models
Image Size
#param
BEV
Depth
Temporal
clean NDS
Adv NDS
clean mAP
Adv mAP
BEVFomer-Smal
1280 x 720
59.6M
0.2623
0.1315
0.1321
0.0567
BEVFormer-B Base
1600 900
09.1M
0.4128
0.1585
0.3461
0.0833
DETR3D
1600 900
53.8M
0.4223
0.1758
0.3469
0.1081
DETR3Dr
1600 900
53.8M
0.4342
0.1953
0.3494
0.1126
PETR-R50
1408 x 512
38,1M
0.3667
0.1193
0.3171
0.0611
PETR-VowNer
1600 x 640
83.1M
0.4550
0.1529
0.4035
0.0838
BEVDepth-R50 R50:
704 x 257
53.1M
0.4057
0.1493
0.3327
0.0923
BEVDeptb-R101$
704 x 257
72.1M
0.1167
0.1533
0.3376
0.1007
HEVDet-RR50 R50+
704 257
48.2M
0.3770
0.1069
0.2987
0.0634
HEVDet-R1011
704 257
67.2M
0.3864
0.1267
0.3021
0.0754
DEVDet-Swin- Tiny?
704 257
55.9M
0.4037
0.1074
0.3080
0.0635
FCOS3D
1600 x
0.3949
0.1339
0.3214
PGD-Det
1600 900
56.2M
0.4089
0.1441
0.3360
0.0843
BEVFurmer Small
1280 x
59.6M
0.4786
0.1593
0.3699
0.1007
BEVFormer-Base
1600 900
69.1M
0.5176
0.1415
0.4167
0.0816
BEVDepthdD-RR
704 257
53.4M
0.4844
0,2144
0.3009
0.1211
BDVDet1DDR50+
704 257
48.2M
0.1570
0.1586
0.3215
0.0770
across various network architectures. The overall training pipeline for this approach is presented in Fig. 4(b) which simulates scenarios where allackers operate without detailed model knowledge or system access.
5
Experiments
5.1 Experimental Setup
To thoroughly assess the model performance, we evaluate both the clean performance and adversarial ro- bustness using the nuScenes dataset. Given the substantial computational resources required for a full dataset evaluation, we opt for the nuScenes-mini dataset when probing adversarial robustness. We report two metrics, Mcan Average Precision (mAP) and nuScenes Detection Score (NDS) (Caesar et al. 2020), in our experiments and discussions. For candidate models, wherever feasible, use the official model configu- rations and publicly available checkpoints provided by open-sourced repositories; furthermore, we also train additional models with minimal modifications to facilitate experiments in controlled environments.
A holistic robustness evaluation necessitates examining models across varying degrees of attack intensity. Consequently, we introduce multiple severity levels for each attack by increasing the iteration count for pixel-based attacks or by adjusting the size of the adversarial patch in patch- attacks. For the detailed performance across these attack severities, interested readers are directed to the Appendix. Detailed parameter configurations for each type of attack are provided below:
Pixel-based Attacks. We evaluate pixel-based adversarial attacks using perturbations under the Coo norm. Our experiment setup fixes the maximum perturbation value at e and the step size at a == == 0.1. The process begins with the introduction of Gaussian noise to randomly perturb input images. Subsequently, we progressively incrcase the number of attack itcrations, ranging from to 50, for both untargeted and localization atlacks. The iteration halts if no prediction results align with the ground truth. For localization attacks, adjust the adversarial objective to L1 loss of the localization, orientation, and velocity predictions while keeping all other settings unchanged. Given that the nuScenes dataset contains six images for every scene with minimal overlap, our attacks targeted individual cameras. For the AutoPGD attack, we use an iteration of 10, the momentum is 0.75 and the initial step size is 0.2r.
Patch-bascd Attacks. The initial patch pattern generated using Gaussian Distribution that has a mean and variance identical the dataset. The attack iteration step size designated as a 5 and we maintained the iteration number at 50. The patch scale is incrementally increased from 0.1 to 0.4.

---

Published in Transactions on Machine Learning Research (01/2024)
BEVForer-
BEVFormer-Bse
425
DETR3D-CBGS
0.8
DETR3D-CBGS
FCO53D
FCOS3D
PGD-Det
PGD-Det
325
BEVDepth-R101
0.9
BEVDepth-R101
BEVDet R101
BEVDet-R10
PETR-Vov
PETR-Vov
6.1
606
608
24 attack lterationn
attack iterations
(a) Pixel-based untargeted attacks.
(b) Pixcl-localization localization attacks.
Figure 3: Mean Average Precision (mAP) value v.s attack iterations. Models behave similarly under un- targeted classification attacks while varying largely under localization attacks. All the models are similarly vulnerable to untargeted attacks while BEV-based exhibit better robustness toward localization attacks.
The adversarial NDS is averaged over all attack severities, f: trained with CBGS Zhu ct al. 2019 S: re-trained models with minimal modification since there no publicly available chockpoint.
Table 3: Overall results:
BEV: BEV-based representations. Depth: Explicit depth estimation. #: Using temporal modeling.
pix-cls
pix-loc
patch-cls
patch-loc
black-box
Models
NDS
mAP
NDS
mAP
NDS
mAP
NDS
mAP
NDS
mAP
BEVFormer-Seee Small
0.1170
0.0284
0.1310
0.0836
0.1428
0.0425
0.1720
0.1096
BEVFormer-BB Base
0.1562
0.0713
DETR3D
0.1700
0.0796
0.19
0.1454
0.1797
0.0664
0.2030
0.16
DETR3Df
0.1921
0.0766
0.1873
0.1543
0.2021
0.0753
0,2183
0.1821
0.3523
0,2708
PETR-R50
0.1256
0.0559
0.1
0.0786
0.0887
0.0338
0.1330
0.0911
0.2350
0.1947
PETR-VowNett
0.1708
0.0883
0.1321
0.0814
0.1352
0.0511
0.1548
0.0989
BEVDepth-Rtu
BEVDepth-R1011
0.1436
0.0726
0.1691
0.1455
0.1301
0.0577
0.1751
0.1414
0.2801
0.1932
REVDet-R50f
0.0806
0.0377
0.0397
0.1562
BEVDet-R101f$
0.1121
0.0559
0.1406
0,1063
0.1176
0,0401
0,1558
0.1094
0.2113
0.1535
BBVDet-Swin-Ting
0.0856
0.0106
0.1058
0.0746
0.1365
0.0632
0.1580
0.1191
FCOS3D
0.1536
0.0861
0.1103
0.0524
0.1225
0.05433
0.1296
0.0799
0.2279
0.1830
PGD-Det
0.1696
0.0947
0.1105
0.0691
0.1126
0,0612
0.1621
0.10-19
0.2137
0.1965
BEVPormer-Smalla
0.1727
0.0964
0.1221
0.0949
0.1746
0.0907
0,1810
0.1388
BBV Base@
0.1328
0.0555
0.1312
0.1017
0.1689
0.0766
0.1910
0.1359
0.3018
0.2603
BEVDepthh4D-ROE R50F #
0.2143
0.0969
0.1914
0. 141488
0. 0.2388
0.0960
0.2425
0.1687
BEVDet1D-R50f
0.139-1
0.0173
0.1499
0.1031
0.0633
0.2157
0.1358
Black-box Attacks. In this black-box setting, we optimize the patch with the nuScenes mini training set (Cassar et al. 2020). We set the learning rate to 10, the patch size to 100 x 100, and the patch scale to 0.3. Our ad versarial objective uses targeted attacks, as Eq. 3 The goal is to misclassify all categories as "Car" and to mislabel "Car" as "Pedestrian". In the inference stage, we apply the trained patch to unseen scenes and different models. To compensate for the occlusion effect induced by the patch, we set a baseline using a random pattern patch, and then assess the relative performance drop.
Attacks for Temporal Models. It is worth noting that BEVFormer incorporates historical features for temporal cross-aliention. This suggests that atlacks on prior frames can affect current, predictions. Thereby, we simulate scenarios where attackers continuously attack multiple frames by modifying every single frame. On the other hand, for BEVDepth4D and BEVDet4D, we attack the current frame while leaving the history frames untouched. Such setting can let us probe if benign temporal information can help in mitigating adversarial effects. More discussions be found in Sec. 5.3.3
8

---

Published in Transactions on Machine Learning Research (01/2024)
OCTR3D
6.22
647
0:22
0.2
6:2
615
66
04
FCD33
1.22
223
PC2
6:56
130
223
62
patch
resize
add
Training data
infer
Surrogate model
ID/Deth
6.34
0.04
0.34
0:34
665
9.00
MRDH
Adversarial loss
update
(a) Transferability Heat Map
(b) Optimization Workflow
Figure 4: Left panel: The horizontal axis corresponds to the largeted model while the vertical axis denotes the source model. Transferability is quantified by the proportional reduction in performance (specifically, mAP) in comparison to randomized patch pattern of identical size. Right panel: The pipeline of the optimization process for the universal patch.
5.2 Main Results
Our main results of PGDAdv Attacks are presented in Tab. and Tab. The Adv NDS and mAP are averaged across all attack types and severities, excluding only the black-box attacks. The results of the AutoPGD Attack are present in Tab. 4 The results of FGSM and C&W attacks can be found in Appendix A
Table 4: Results of AutoPGD Croce & Hein
2020 attack.
Model
NDS
mAP
mATE
mASE
mAOE
mAVE
mAAE
DETR3D
0.1373
0.0522
0.9419
0.5150
1.0066
1.2340
0.4311
PETR
0.0880
0.0094
1.0032
0.6438
0.8749
1.2613
0.6482
FCOS3D
0.1562
0.0507
0.8930
0.4965
0.9639
1.0070
0.3380
PGD-Dev 0.1700
0.0544
0.8494
0.5297
0.8157
1.2942
0.3775
BEVDet.
0.0766
0.0203
1.0156
0.6403
1.0308
1.1250
0.6847
Overall, we interestingly note that all the existing camera- based detectors are vulnerable to adversarial attacks, e.g., the adversarial NDS of all models (except BEVDepth-4DD is lower than 0.2 for PGD-Adv Attacks. Furthermore, we find that AutoPGD can severely compromise the performance of the detection models by only leveraging 10 steps iteration, as shown Tab. 4 Tn terms of the allack categories, pixel-based attacks tend be more malicious than patch-based based ones, indicating that superimposing patch patterns onto target objects generally leads to less adversarial effects than pixel alterations. This finding concurs with the understanding that adversarial patches, being modifications of only specific image segments, naturally cause restricted ad versariia perturbations Furthermore, we find that attacks that aim to confuse classification have a greater adversarial effect than those meant to mislead localization. This observation holds for both pixel-based and patch-base based attacks. Nevertheless, as illustrated in Fig. 8 the discrepancy model robustness is more pronounced under localization attacks, indicating a variable degree of vulnerability in accurately identifying object locations.
For black-box attacks, adversarial examples from monocular detectors exhibit enhanced transferability, even to BEV-based models, illustrated in Fig. 4(a) Universal patches trained using FCOS3D or PGD-Det demonstrate strong transfcrability among various models. For instance, transferring attacks from FCOS3D to PETR led to a relative performance decline exceeding 70%. On the other hand, BEVDet and BEVDepth produce adversarial examples with limited transferability and show reduced susceptibility to universal patch attacks. Notably, the patch maintains its adversarial nature even after resizing different shapes and scales. Such universal patch, spanning various images, models, and scales, presents a pronounced potential threat for camera-based detectors, especially given the zero-risk tolerance in autonomous driving contexts.
9

---

Published in Transactions on Machine Learning Research (01/2024)
0.2
0.15
0.1
0.05
0.05
Pixel cls
Pixel loc
Patch cls
Patch loc
Pixel als
Pixel loc
Patch cls #BVVDepth-R50
Patch loc
FCOS3D
BEV
PGD-Det
BEVDepth-500
FCOS3D
BEVDet-R50
PGD-Det
(a) NDS Metric
(b) mAP Metric
Figure 5: Comparisons between BEV- models and non non-BEV BEV-based models.
Adv NDS
Adv NDS
0.20
0.200
0.15
0.175
0.10
0.150
BEV
0.125
0.05
False
BEVDet swin-l
True
0.100
0.00
0.30
0.40
0.25
0.30
0.35
0.40
0.45
Clean NDS
Clean NDS
(a) BEV: Cls. Atlack
(b) BEV: Loc. Attack
Adv NDS
Adv NDS
0.20
Depth
0.175
False
0.18
True
0.150
0.16
0.125
0.14
0.100
0.12
0.25
0.30
0.35
0.40
0.25
0.30
0.35
0,40
Clean NDS
Clean NDS
(c) Depth: Cla. Attack
(d) Depth: Loc. Attack
Comparison between non-BEV-based models and BEV-based models. Right: Comparison between depth- besth-based and depth-free models.
Figure 6: Left:
5.3
Discussions
We next provide in-depth discussion about these results. For better analysis, primarily focus three model components: BEV representation, Depth (i.e., the incorporation of an explicit depth estimation branch for BEV transformation), and Temporal Modeling (i.e., the ability to learn from multi-frame inputs).
5.3.1 BEV-based Representations
BEV-based models are generally vulnerable to classification attacks but show notable robustness to localization attacks. To probe if BEV delectors retain their superiority over monocular detectors under adversarial attacks, we select four models for comparison: BEVDet (Huang et al, 2021), BEVDepth (Li et al.) (022a)), FCOS3D (Wang et al.] 2021). and PGD-Det (Wagg al.) 2022a), as they exhibit similar performance under standard conditions and all employ the 1esNet101 backbone. As shown in Fig. 5 we observe that. BEV-based methods generally fail to showcase clear advantage in terms of robustness
10

---

Published in Transactions on Machine Learning Research (01/2024)
against untargeted attacks. However, interestingly note that BEV-based models demonstrate superior performance under localization attacks under the pixel-based localization attacks, the adversarial NDS of BEVDepth outperforms PGD-Det by about 53%. This conclusion is further corroborated in Fig. 6(a) and
Fig. 6(b)
5.3.2 Explicit Depth Estimation
Precise depth estimation is crucial for depth-based models. Additionally, depth-free methods have the potential to yield stronger robustness. Our analysis suggests that models with more precise depth estimation capabilities typically exhibit enhanced robustness against adversarial attacks. As seen in Fig. PGD-Det outperforms FCOS3D by leveraging superior depth estimation. This enhanced depth estimation results in consistent robustness improvement across all attack types. Additionally, the comparison between BEVDel and BEVDepth, which differ only in their depth estimation module, shows that the accurate depth estimation in BEVDepth can lead to 39.6% increase in robustness.
Furthermore, found that depth-estimation-fre approaches (Li et al. 2022b Wang et al. 2022b Liu et al. 2022a) generally show advantages over depth-based detectors under classilicat ion altacks (Fig. 6(c) Interestingly, for localization attacks, depth-based models can outperform some depth-free models, if the depth estimation sufficiently accurate, as shown in Fig. [(d) Nonetheless, DETR3D (Wang et al. 2022b)
still shows the best robustness, suggesting that carefully designed depth- free methods have the potential for superior robustness.
5.3.3 Temporal Fusion
The effects of adversarial attacks can be mitigated using clean temporal information, but they might be exacerbated when multi-frame adversarial inputs are used. To investigate the impact of temporal information on adversarial robustness, we introduce two distinct attack scenarios. For the BEVFormer model, which updates its history of BEV queries on the fly, we allack each input frame. This results all sequential inputs used for temporal information modeling being adversarial examples, causing an accumulation of errors within the model through retained temporal data. Our experiments reveal that the BEVFormer-Baat Base model, when using temporal information, underperforms compared to its single-frame variant (i.e., 0.1585 u.s. 0.1445). To further demonstrate the influence of temporal fusion, we simulate three cases: (a) Benign case: The model processes clean input across multiple frames. (b) Continuous adversarial attack: The model processes adversarial input persistently across multiple frames. (c) Single adversarial attack: The model processes clean input followed by adversarial input at a singular frame. We use the benign case as the ground truth and calculate the error on BEV temporal features according it. The results presented in Tab. 5 further prove the observation. In the second scenario, we attack the current timestamp imput while preserving historical information untouched. Under this condition, test BEVDepth4D and BEVDet4D, which integrate features from the current frame and recent historical frame in their predictions. As shown in Tab. 2 we observe that clean temporal information significantly reduces the adversarial effect in this scenario, with 0. u.s. 0.2144 for BEVDepth, and 0.1069 v.s. 0.1586 for BEVDet.
Table 5: Error between adversarial BEV features and benign BEV features under different frames.
Scenario
framel
frame3
frame5
frame7
frame9
framel1
Continuous adversarial attack
0.11
0.27
0.23
0.28
0.25
0.22
Single adversarial attack
0
0
0
0.16
5.3.4 Others
Strategies specifically designed to tackle long-tail problems can concurrently improve model robustness. Object detection often faces long-tail challenges, where certain categories like "Car" and "Pedestrian" are significantly more prevalent than others, such "Motorcycle". Our findings suggest that
11

---

Published in Transactions on Machine Learning Research (01/2024)
BHPhome-Smal
DETRID-C9US
FCO53D
NiD-Dut
REVDrpth R50
Adversarial NDS
BEvD R101
nrvhe-250
BE-Det
Suiphiny
PETR.850
PETRMAE
50
60
70
Model Size (M)
Figure 7: Comparison between different model sizes: For the same model, an increase in parameter size typically leads to enhanced robustness against adversarial attacks.
strategies designed to address long-tail problems, such as class- balsncal group sampling (CBGS) training (Zhu al. 2019), can also improve robustness. Our results show that DETR3D trained with CBGS improves adversarial NDS by about 11%. This observation contrasts with (Wu al., 2021), which suggested that resampling training strategies minimally impact robustness. Nonetheless, it is important to note that study considers detection tasks, which are different from the classification tasks in (Wu et al. 2021
Increasing the backbone size consistently leads to improved robustness. We investigate the impact of different backbone architectures, including ResNet (He et al. 2016), VoVNet (Tee et al. 2019). and Swin- Transformer (Liu et al, 2021). on the robustness of models. We first compare Swin- Tiny and ResNet50, as their parameter sizes are similar (23.6M u.s. 27.5M). Although they perform slightly differently under various attacks, the overall robustness of ResNet50 and Swin-Tiny similar (i.e., 0.1069 u.s. 0.1074). On the other hand, the VovNet outperforms in both standard and adversarial robustness. Additionally, find increasing the backbone size consistently leads to improved robustness. This trend is particularly noticeable for models with weaker robustness, as illustrated in Fig.
6 Ethical and Societal Considerations
This study addresses the threats of adversarial atlacks in camera-based 3D detection models, focusing pri- marily digital attacks. We emphasize the need to extend this research include physical attack scenarios in future work, due to their significant potential impact autonomous driving systems. Ethically, our re- search highlights the crucial responsibility of developers to ensure the safety and reliability of these systems, especially in public spaces where they are more vulnerable to adversarial attacks. The broader impacts of our study underline the importance of integrating strong security measures both the development and deployment of such technologies. This is vital to reduce the risk of harm to society and promote safer, more ethical approach using technology in critical safety applications.
7 Conclusions
We conduct an exhaustive analysis of adversarial robustness in camera-based 3D object delection models. Our findings reveal that model's robustness does not necessarily align with its performance under normal conditions. Through our investigation, we successfully pinpoint several stratogies that can enhance robust- ness. We hope our findings will contribute valuable insights the development of more robust camera-based object detectors in the future.
12

---

Published in Transactions on Machine Learning Research (01/2024)
Acknowledgement
This work is partially supported by a gift from Open Philanthropy and UCSC Office of Research Seed Fund- ing for Early Stage Initiatives. This work is based upon the work supported by the National Center for Transportation Cybersecurity and Resiliency (TraCR) (a U.S. Department of Transportation National Uni- versity Transportation Center) headquartered at Clemson University, Clemson, South Carolina, USA. Any opinions, findings, conclusions, and recommendations expressed in this material those of the author(s) and do not necessarily reflect the views of TraCR, and the U.S. Government assumes no liability for the contents or use thereof.
References
Yutong Bai, Jieru Mei, Alan L Yuille, and Cihang Xie. Are transformers more robust than cnns? Advances in Neural Information Processing Systems, 34:26831-2668 26843, 2021.
Tom B Brown, Dandelion Mané, Aurko Roy, Martin Abadi, and Justin Gilmer. Adversarial patch. arXiv preprint ar Xrxiv:171 1/1: 2. 09665, 2017.
Holger Caesar, Varun Bankiti, Alex H Lang, Sourabh Vora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom. nuscenes: A multimodal dataset for autonomous driving. Proceedings of the IEEE/CVI conference on computer vision and pattern recognition, pp. 11621 11631, 2020.
Yulong Cao, Ningfei Wang, Chaowei Xiao, Dawei Yang, Jin Fang, Ruigang Yang, Qi Alfred Chen, Mingyan Liu, and Bo Li. Invisible for both camera and lidar: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks In 2021 IEFE Symposium on Security and Prinacy (SP), pp. 176 194. IEEE, 2021.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium security and privacy (sp), pp. 39 57. leee, 2017.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206-2216. PMLR, 2020.
Andreas Geiger, Philip Lenz, and Raquel Urtasun. Are ready for autonomous driving? the kitti vision benchmark suite. In 2012 IEEE conference on computer vision and pattern recognition, pp. 3354-3361.
IEEE, 2012.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint ar XiX:::1122 6572, 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Junjie Huang and Guan Huang. BevdetAd: Exploit temporal cues in multi-camera 3d object detection. arXiv preprint Xrv: 1754,, 2022.
Junjie Huang, Guan Huang, Zheng Zhu, and Dalong Du Bevdet: High-performance multi-camera 3d object detection in bird-cyo-view. arXiv preprint 1Xxi::2122.1100000 2021.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXio preprint arXiv:1412. 6980, 2014.
Alex H Lang, Sourabh Vora, Holger Caesar, Lubing Zhou, Jiong Yang, and Oscar Beijbom. Pointpillars: Fast encoders for object detection from point clouds. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition, pp. 12697-12705, 2019.
Youngwan Loe, Joong-won Hwang, Sangrok Lec, Yuscok Bac, and Jongyoul Park. An energy and gpu- computation efficient backbone network for real-time object detection. In Proceedings of the IEEE/CVF conference computer vision and pallern recognition workshops, pp. 0 0, 2019.
13

---

Published in Transactions on Machine Learning Research (01/2024)
Yinhao Li, Zheng Ge, Guanyi Yu, Jinrong Yang, Zengran Wang, Yukang Shi, Jianjian Sun, and Zem- ing Li. Bevdepth: Acquisition of reliable depth for multi-view 3d object detection. ar preprinl arXiv:2206. 10092, 2022a.
Zhiqi Li, Wenhai Wang, Hongyang Li, Enze Xie, Chonghao Sima, Tong Lu, Qiao Yu, and Jifeng Dai. Bevformer: Learning bird's-eye-view representation from multi-camera images via spatiotemporal trans- formers. arXiv preprint 1xXi:22203.17700 2022b.
Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Hai Li, and Yiran Chen. Dpatch: An adversarial patch attack on object detectors. arXiv preprint (rXi::1866. 02299, 2018.
Yingfei Liu, Tiancai Wang, Xiangyu Zhang, and Jian Sun. Petr: Position embedding transformation for multi-view 3d object detection. arXiv preprint ar 0rxi::20030050: 2022a.
Yingfei Liu, Junjic Yan, Fan Jia, Shuailin Li, Qi Gao, Tiancai Wang, Xiangyu Zhang, and Jian Sun. Petrv2: A unified framework for 3d perception from multi-camera images. aie preprint orxiv:2206. 01256, 2022b.
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVP International Conference on Computer Vision, pp. 10012 1000222 2021.
Yuexin Ma, Tai Wang, Xuyang Bai, Huitong Yang, Yuenan Hou, Yaming Wang, Yu Qiao, Ruigang Yang, Di- nesh Manocha, and Xinge Zhu. Vision-centric bev perception: A survey, arXiv preprint arXiv:2208.088 027997 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint or arXiv 1706 060600 2017.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1765 1773, 2017.
Jonah Philion and Sanja Fidler. Lift, splat, shoot: Encoding images from arbitrary camera rigs by implicitly unprojecting to 3d. In Europeun Conference on Compuler Vision, pp. 194 210. Springer, 2020.
Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. Advances in neural information processing systems, 28, 2015.
Giulio Rossolini, Federico Nesti, Gianluca D' A'mcco, Saasha Nair, Alessandro Biondi, and Giorgio Buttazzo. On the wollw adversarial robustness of real-time semantic segmentation models for autonomous driv-
ing. a'v preprinl (rXiw:2201.0185/ 2022.
Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Ye Yu Chen, and Cho-Jui Hsich. On the adversarial robustness of vision transformers. Xixiu preprint ar Xix:22100.. 15670, 2021.
Pei Sun, Henrik Kretzschmar, Xerxes Dotiwalla, Aurelien Chouard, Vijaysai Patnaik, Paul Tsui, James Guo, Yin Zhou, Yuning Chai, Benjamin Caine, al. Scalability in perception for autonomous driving: Waymo open dataset. In Proceedings of the IEEE/CVE conference computer vision and pattern recognition, pp. 1446-2454 2020.
Christian Szegedy, Wojeiech Zaremba, Nyy Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXio preprint 1xXi:1112.61990 2013.
Zhi Tian, Chunhua Shen, Hao Chen, and Tong He. Feos: Fully convolutional one-stage object detection. Tn Proceedings of the IEEE/CVE international conference on computer vision, pp. 9627-9636, 2019.
James Tu, Mengye Ren, Sivabalan Manivasagam, Ming Liang, Bin Yang, Richard Du, Frank Cheng, and Raquel Urtasun. Physically realizable adversarial examples for lidar object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 13716 13716-13725, 2020.
14

---

Published in Transactions on Machine Learning Research (01/2024)
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural informalion processing systems, 30, 2017.
Sourabh Vora, Alex H Lang, Bassam Helou, and Oscar Beijbom. Pointpainting: Sequential fusion for 3d object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 4604 1604-4612, 2020.
Tai Wang, Xinge Zhu, Jiangmiao Pang, and Dahua Lin. Fcos3d: Fully convolutional ono-stage monocular 3d object detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp- 913 2021.
Tai Wang, ZHU Xinge, Jiangmiao Pang, and Dahua Lin. Probabilistic and geometric depth: Detecting objects in perspective. In Conference on Robot Learning, pp. 1475-1485. PMLR, 2022a.
Yue Wang, Vitor Campagnolo Guizilini, Tianyuan Zhang, Yilun Wang, Hang Zhao, and Justin Solomon. Detr3d: 3d object detection from multi-view images via 3d-to-2d queries. In Conference on Robot Learning, pp. 180-191. PMLR, 2022b.
Tong Wu, Ziwei Liu, Qingqiu Huang, Yu Wang, and Dahua Lin. Adversarial robustness under long-tailed distribution. In Proceedings of the JEEE/CVP conference on computer vision and pattern recognition, pp. 8659 8668, 2021.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE international conference computer vision, pp. 1369-1378, 2017.
Yan Yan, Yuxing Mao, and Bo Li. Second: Sparsely embedded convolutional detection. Sensors, 18(10): 3337, 2018.
Yin Zhou and Oncel Tuzel. Voxelnet: End-to-end learning for point cloud based 3d object detection. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4490-449M 2018.
Benjin Zhu, Zhengkai Jiang, Xiangxin Zhou, Zeming Li, and Gang Yu. Class-balanced grouping and sampling for point cloud 3d object detection. arXiv preprint wwX.::190.0094000 2019.
Zijian Zhu, Yichi Zhang, Hai Chen, Yinpeng Dong, Shu Zhao, Wenbo Ding, Jiachen Zhong, and Shibao Zheng. Understanding the robustness of 3d object detection with bird's-cyo-viow representations in au- tonomous driving, In Proceedings of the IEEE/CVF Conference on Compuler Vision and Pollern Recog- nition, pp. 11600-21610,,, 2023.
15

---

Published in Transactions on Machine Learning Research (01/2024)
A More Adversarial Attacks Results
We provide the results of FGSM (Goodfellow et al. 2014 and C&W attack (Carlini & Wagner 2017 in this section. The results can be found fron Tab. 6 to Tab. g We observe that in the context of 3D object detection, even single-step FGSM can compromise the performance of models to a large extent, which further reveals the vulncrability of these models. The attack effectiveness of the C&W attack is close to the FGSM attack. However, the C&W W attack needs more sleps optimize, which might limit their real-world application usage.
Table 6: Results of FGSM Classification attack.
Model
NDS
mAP
mATE
mASE
mAOE
mAVE
mAAE
DETR3D
0.2259
0.1406
0.9066
0.4804
0.7946
0.9122
0.3498
PETR
0.1501
0.0710
0.9419
0.5616
0.9664
0.9048
0.4789
BEVDet
0.1427
0.0603
1.0925
0.4855
1.1231
1.1421
0.3884
FCOS3D
0.1712
0.1104
0.9319
0.5034
1.0274
1.3144
0.4053
PGD-Dev
0.1848
0.0865
0.9440
0.5292
0.8091
0.9069
0.3949
Table 7: Results of FGSM Localization attack.
Model
NDS
mAP
mATE
mASE
mAOE
mAVE
mAAE
DETR3D
0.2441
0.2095
0.8805
0.4892
0.7957
1.1887
0.4413
PETR
0.1778
0.1273
0.9900
0.4739
1.0308
1.1836
0.3951
BEVDet
0.1675
0.1249
0.9852
0.4984
1.0121
1.2842
0.4655
FCOS3D
0.1583
0.0942
0.9647
0.4982
0.9403
1.5566
0.4852
PGD-Dev
0.1606
0.0960
1.0325
0.5231
0.9541
1.0494
0.3963
Table 8: Results of C&W Classification attack.
Model
NDS
mAP
mATE
mASE
mAOE
mAVE
mAAE
DETR3D
0.2765
0.2030
0.8686
0.4752
0.7202
0.8435
0.3419
PETR
0.1656
0.1167
0.9507
0.4833
1.0228
1.5613
0.4938
FCOS3D
0.1119
0.0730
1.0815
0.5873
1.0157
1.0151
0.6586
PGD-Dev
0.1585
0.0924
1.0400
0.5003
0.8569
1.3132
0.5195
Table 9: Results C&W Localization attack.
Model
NDS
mAP
mATE
mASE
mAOE
mAVE
mAAE
DETR3D
0.2793
0.1461
0.8809
0.4635
0.7118
0.5647
0.3165
PETR
0.1681
0.0870
0.8943
0.4938
0.9151
1.3880
0.4513
FCOS3D
0.1217
0.0632
1.0194
0.5774
0.8748
1.4137
0.6470
PGD-Dev
0.1485
0.0761
0.9929
0.5214
0.9067
1.3131
0.4745
B Dynamical Patch v.s. Fixed-size Patch
We compare the results of the dynamical patch and fixed-size patch. In our paper, we choose to use dynamical size patches because it is more physically reasonable. Real-world patch size changes according to distance from sensors. Attackers only need smaller patch for pedestrians to fool the detectors while might need
16

---

Published in Transactions on Machine Learning Research (01/2024)
larger one for larger objects (i.e., Car and Bus). As result, it is not reasonable nor fair to apply fixed patch size to every object. To explain the difference, we calculate the detection results of each class, the
comparison can be seen in Fig. S The results are evaluated using BEVFormer-Base(L. et al. 2022b) with temporal information on nuScenes Cacsar et al. 2020 mini validation set. We calculate the relative AP drop compared clean input.
10-
Car Bix
10-
Ca"
Taffic Cone Pedestran
Trafic Cone Fadlestrian
0.4
0.4
0.2
0.2
10
15
50
35
0.20
5.55
0.10
0.15
0.20
0.25
0.30
0.20
0.40
(Watch kimm
patch scale
(a) Fixed-size patch.
(b) Dynamical-size patch.
Figure 8: Comparison between different patch size scttings.
Table 10: For PGD-Det model, the adversarial universal patch trained on nuScenes can transfer to KITTI.
Type
Easy
Moderate
Hard
Clean
64.4
54.5
49.2
Random Patch
53.6
44.4
39.4
Adv Patch
44.2
37.2
32.8
C Black-Box Box Transfer Attacks
Here we provide the full results of universal patch- black box transfer attacks as shown in Tab. and Tab. I2 We conduct universal patch attacks using BEVVorrmer-base/ Li et al.] 2022b) without tempo- al.] 2022a), DEVDepth-R101 et al. 2022a), and BEVDet- Huang al. 2021 Among the above models, DETR3D Wang al. 2022b). DEVDet (Huang al. 2021), and BEV Lepth(Li et al.) 2022a) are trained with CBGS strategy. Considering the occlusion induced by patches, we randomly initialize the patch with the same size to serve as the baseline. To further verify the transferability of the generated universal patch, we utilize the universal patch trained by PGD-Det to KITTI (Geiger et al. 2012) dataset. We show that the universal patch generated using nuScenes (Caesar et al. 2020) can effectively transfer to KITTI (Geiger et al. 2012), as shown in Tab. I0 This further validates the existence of universal adversarial patterns in 3D detection tasks.
ral information, DETR3D DETR3D(Wang et al.) 2022b), L5
D Visualization of Depth Estimation
We visualize the depth estimation results of BEVDet (Huang et al. 2021 and BEVDepth (Li et al., 2022a) in Fig. g to further show the importance of precise depth estimation for depth-based approaches. Due the guidance from sparse LiDAR points, BEVDepth consistently yielded superior depth estimation results, contributing to its heightened robustness.
17

---

Published in Transactions on Machine Learning Research (01/2024)
Figure 9: Depth ostimation results. From left to right: original FRONT camera images, BEVDepth L
et al. 2022a) depth prediction results, BEVDet (Huang et al. 2021 depth prediction results.
Accurate
depth estimation provides the model with strong robustness.
Adversarial Source
BEVForrer
DETR3D
PETR
FCOS3D
PGD-Det
BEVDet
BEVDepth
Random Noise
0.2816
0.3014
0.2515
0.2379
0.2546
0.1924
0.2380
BEVForeer
0.2663
0.2827
0.2301
0.2098
0.2316
0.1676
0.2132
DETR3D
0.2767
0.2799
0.2195
0.1936
0.2221
0.1634
0.2017
PETR
0.2561
0.2613
0.1236
0.1825
0.1904
0.1256
0.1895
FCOS3D
0.2205
0.2266
0.0683
0.0724
0.0893
0.1018
0.1410
PGD-Dett 0.2357
0.2463
0.1805
0.1069
0.0879
0.1186
0.1128
BEVDet 0.2760
0.2807
0.2416
0.2334
0.2513
0.1758
0.2283
BEVDepth
0.2693
0.2874
0.2422
0.2275
0.2445
0.1829
0.2213
Table 11: Universal patch black box attacks: full results of mAP. The X-axis represents the target models and Y-axis represents the source white box models.
Adversarial Source
BEVFormer
DETR3D
PETR
FCOS3D
PGD-Det
BEVDet
BEVDepth
Random Noise
0.3179
0.3746
0.2857
0.2776
0.2919
0.2670
0.3206
BEVFormer
0.3141
0.3589
0.2648
0.2475
0.2696
0.2254
0.2965
DETR3D
0.3235
0.3609
0.2566
0.2264
0.2592
0.2177
0.2876
PETR
0.2954
0.3412
0.1890
0.2127
0.2396
0.1769
0.2804
FCOS3D
0.2604
0.3149
0.1125
0.1473
0.1669
0.1461
0.2336
PGD-Det 0,2811
0.3350
0.2315
0.1733
0.1670
0.1552
0,2080
BEVDet 0.3079
0.3672
0.2715
0.2734
0.2807
0.2551
0.3131
BEVDepth 0.3140
0.3655
0.2687
0.2648
0.2750
0.2467
0.3011
Table 12: Universal patch black box attacks: full results of NDS. The X-axis represents the target models and Y-axis represents the source white box models.
E Full Results
In this part, list the full experiment results. We present the mAP and NDS metrics of all the models under 4 types of attacks (i.e., the attack iterations or the patch scale). For cach attack, we use multiple allack severities to minimize randomness. We set the random seed to for all experiments. The curves are
plotted from Fig. 10 to Fig. 13
18

---

Published in Transactions on Machine Learning Research (01/2024)
BEVFarmerSmal @BVFamerrmmall-iig BEVFormerBasee Temp
BEVFormen Small
BEVFurmen Smplll-pS
120
BEViorme-Base
BEVFormer Base Tomp
NDS
sttack lterations
attack tenatirs
(a) Pixel-based untargeted attckks: mPP attack iter- (b) Pixel-hased untargeted attacks: NDS attakk
ations.
ations.
BEVFormer
BEVFormer Small
REVFammermmillae TTmmp
SEVFormee-Sraee Small-TTmm
BBV Breer
BEvtormer
aFVFarmer
attack Iterations
Iterations
(c) Pixel-based localization attacks: mAP attack it- (d) Pixel-based localization attacks: NDS attack iter- ations.
erations.
SEVFarmerSmal
BEVFormen Small
BEVFameesSmall
SEVerrme-SrallTTen
BE aaverrmerdaeee
BEVrormen marrrmmr-aee
21
BeVformeeBase-Tere
NDS
4.14
414
118
0.0
(e) Patch-based untargeted attacks: mAP n.s. patch scale. (f) Patch-based untargeted attacks: NDS u.s. patch scale.
Sevaller-Small
BEVRormer-Sral
SeViame--malllleng
aeViorme-Small-tenn
BEVForme PaPFFee--Baeeaaaae
BEVFormer Base
BDS
8:34
611
618
65
45s
63e
110
630
67e
0.0
67
pabch
patch
(g) Patch-based localization attacks: mAP u.s. patch scale. (h) Patch-bused localization attacks: NDS patch scale.
Figure 10: BEVFormer full results.
19

---

Published in Transactions on Machine Learning Research (01/2024)
DETRED
DETR3D
DETRED-CBGS
435
DETRSD-CBGS
PETR-VVV
PETR-VOV
228
4.28
110
190
500
attack Iteratlo
attack Itorations
(a) Pixel-based untargeted attacks: mAP u.s. attack
(b) Pixel-based untargeted attacks: NDS u.s. attack itera- tions.
tions.
646
DETRED-CBCS
BETALS-CBBGS
PETR-R00
PETR-R50
PETI-Vov
PETR-VVV
528
4.22
818
512
012
010
attack
Iterations
(c) Pixel-based localization attacks: mAP n.S. attack iter- (d) Pixel-hased localization attacks: NDS attack iter-
ations.
ations.
DETR3D
DETRSD-CBCS
DETR3D-CBGS
PETR-R00
PETR-R50
PETN-Vov
PETR-Kov
m60
110
0.0
325
(e) Patch-based untargeted attacks: mAP u.S. patch scale. (f) Patch-based untargeted attacks: NDS u.s. patch scale.
DETRED-CBGS
DETRUD-CBGS
PETR-R50 PETR-VoV
PETR-R50 PETR-Vov
8.4
612
65
45s
63
630
0,0
67
pabch
patch
(g) Patch-based localization attacks: mAP a.s. patch scale. (h) Patch-bused localization attacks: NDS patch scale.
Figure 11: DETR3D and PETR full results.
20

---

Published in Transactions on Machine Learning Research (01/2024)
BEVDepth-Ar R102
BEVDepth- R101
BEVDxpti-R50
BE/DuptthA5O
BEXDepth4D-850
BEVDeptheD-850
BEVDet R50
BEVDet
428
BEVDet-RLE
BEVDet- #101
4.24
BEVDeMID R50
NDS
BEVDet4D 850
411
1.0
190
attack Iteratlo
attack teratirss
(a) Fixel-based untargeted attacks: mAP u.s. attack (b) Pixel-based untargeted attacks: NDS u.s. attack itera-
tions.
tions.
BEVDepth
BEVDepth
BEVibpat-R50
BEVDepth-AS0
BEVDDpph4D--500
BrVDepth4D-r50
BFVDel-R50
214
BEVDet- A101
BEVDet-R101
BEVDet4D R50
BEVDet4D A50
818
(c) Pixel-based localization attacks: mAP M.S. attack iter- (d) Pixel-hasee localization attacks: NDS attack iter-
ations.
ations.
BEVDepth
BEVDepth
BEVDsptI-n5O
BEVDupth.R50
DEXDepth-A--550
BEVDepth
BFVDet-R50
BFVDet-It50
BEVDet-
BEVDet-
BEVDet4D R50
BEVDet4D-R50
500
020
(e) Patch-based untargeted attacks: mAP u.S. patch scale. (f) Patch-based untargeted attacks: NDS W.s. patch scale.
BENDspti-RLO1
BEVDspth-R10t
BEVidppth-RO
BEVDepth-R50
BEVDepth4D-HR R50
BEVDepth
BEVDet-R50
BEVDet-R50
1.8
BEVDet R101
BEVDet R101
BEVDwtAD-R50
BeVDer4D-850
NDS
4.18
012
65
45s
63e
630
67e
0.0
pabch
patch
(g) Patch-based localization attacks: mAP u.s. patch scale. (h) Patch-bused localization attacks: NDS patch scalc.
Figure 12: BEVDet and BEVDepth full results.
21

---

Published in Transactions on Machine Learning Research (01/2024)
FC0530
FCO53D PCD-Det
PGD-Dat
6.00
617
610
590
190
500
attack Iteratio
attack Iterations
(a) bixel- untargeted attacks: mAP u.s. attack
(b) Pixel-based untargeted attacks: NDS u.s. attack itera- tions.
Lions.
4.5
FCO53D PGD-Dat
PCD-Det
6.28
510
1.5
attack
attack Iterations
(c) Pixel-based localization attacks: mAP n.S. attack iter- (d) Pixel-hasee localization attacks: NDS attack iter-
ations.
ations.
FCO53D PGD-Dat
05
FCOS3D PCD-Dat
4.5
414
112
0.0
325
(e) Patch-based untargeted attacks: mAP u.S. patch scale. (f) Patch-based untargeted attacks: NDS u.s. patch scale.
ICO53D
PGD-Det
510
013
616
65s
63e
605
630
0,0
pabch
patch
(g) Patch-based localization attacks: mAP 8.s. patch scale. (h) Patch-bused localization attacks: NDS v.s. patch scale.
Figure 13: FCOS3D and PGD-Det full results
22


Reviews:
[{"review_id": "MuggKDjT1w", "reviewer": "Reviewer_Vdtq", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strength**\n1. The problem studied by the work is interesting to the community of both 3D vision and adversarial machine learning and closely related to the latest research with safety-critical real-world applications like autonomous driving based on camera vision.\n2. The camera-based 3D object detection approaches covered by the work are new and comprehensive.\n3. The experiment study settings are comprehensive, considering different adversarial attack methods and different targets. The comprehensiveness of the experiment settings also make the conclusions of the work solid.\n4. The study results are well-presented with clear descriptions of background knowledge and experiment settings, making the work very readable.\n\n**Weakness**\n1. The white-box adversarial attack approaches only include PGD. However, there are other standard adversarial attack approaches including fast gradient sign method [1] and Carlini & Wagner [2] with strengths and shortcomings different from PGD. It would make the study even more comprehensive and the conclusions more solid if the study can show how effective these methods are against the 3D object detection approaches.\n2. Since study is closely related to safety-critical real-world problems, the work should include a dedicated part discussing the real-world threats of the studied adversarial settings, ethical concerns, and broader impacts of the study's results.\n\n    \n[1] Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. \"Explaining and harnessing adversarial examples.\" arXiv preprint arXiv:1412.6572 (2014).\n\n[2] Carlini, Nicholas, and David Wagner. \"Towards evaluating the robustness of neural networks.\" 2017 ieee symposium on security and privacy (sp). Ieee, 2017.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The work studies adversarial robustness of different camera-based 3D object detection approaches comprehensively. The 3D object detection approaches covered by the study include monocular approach and approaches based on bird's-eye-view (BEV) representations with or without depth estimation. The study considers pixel and patch based attack approaches using projected gradient descents (PGD) as well as black-box attack method. The work studies both clean performance, adversarial robustness, and the transferability of adversarial perturbations across models on the standard nuScenes dataset and draws critical and useful insights from the experiment results from the following perspectives: the use of BEV representations, explicit depth estimation, using temporal information, long-tail distribution of object classes, and model size.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "**Requested Changes**\n\nThe work should include a Broader Impact Statement discussing the real-world threats of the studied adversarial settings, ethical concerns, and broader impacts of the study's results. \n\n\n**Suggested Changes**\n\nI would encourage the authors to include study results based on other standard adversarial attack methods like FGSM and Carlini & Wagner in their study.", "broader_impact_concerns": "The work should not be exempt from having a Broader Impact Statement. Please see **Weaknesses** and **Requested Changes**.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "NOTCgakVlm", "reviewer": "Reviewer_zozS", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n+ The paper clearly categorizes the adversarial attacks against 3D object detection.\n\n+ The experiments are of a large scale and the corresponding findings are meaningful.  \n\nWeaknesses:\n\n- The clean performance of the evaluated models is low.\n\n- The differences in results are not that significant.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper conducts a comprehensive evaluation of 3D object detection methods against adversarial attacks. The authors categorize the existing 3D object detection methods into a few classes and evaluate their robustness against pixel-level and patch-level adversarial attacks, respectively. The results points to four findings.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "I am not familiar with the 3D object detection domain, so please correct me if I am wrong. The clean performance of the selected models seems relatively low. Most of the models have only 0.3-0.4 precision and detection scores. I am not sure if these are really state-of-the-art performances.  I would suggest the authors explicitly justify this or use models with better performance for evaluation. IMHO, it is more valuable to attack models with high performance rather than mediocre models. \n\nThe differences in attack performance are not that significant. To better support the arguments and findings of the paper, it would be more rigorous if the authors conduct the experiments multiple times, reporting the mean and stand devotion together with the paired t-test results.", "broader_impact_concerns": "Not applicable.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "jG9whZkMIW", "reviewer": "Reviewer_EhUz", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\n\n1. The experimental setting and analysis is exhaustive, providing insightful indications on robust 3D model design. \n2. The figures and the tables are self-explanatory. The paper is well-written and is easy to follow.\n\n**Weakness**\n\n1. The paper shows several techniques (i.e., BEV-based representation, explicit depth estimation, temporal fusion, etc.) can help improve the adversarial robustness by comparing the empirical adversarial robustness of models using different combinations of these techniques. It would be better if the authors could provide deeper understanding on this and explain why these techniques could help using theoretical analysis or a more fine-grained ablation study.\n2. I am curious what is the strongest attack for 3D models. The authors considered PGD-based methods and patch-based methods, which is great. But I would like to learn how is the model's performance against even stronger attack like AutoAttack (Croce et al., 2020).", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper conducts an investigation of the robustness of leading camera-based 3D object detection approaches under various adversarial conditions. It evaluates the robustness against pixel-based and patch-based adversarial attacks in classification and localization tasks. The paper found four techniques can potentially help improve the robustness: bird's-eye-view-based representations, depth-estimation-free approaches, accurate depth estimation, and multi-frame benign inputs. The authors conduct comprehensive experiments and show interesting results on designs that can benefit the adversarial robustness.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "See weakness above.", "broader_impact_concerns": "No concern.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The adversarial robustness of 3D point models is an interesting research problem studied by the authors. The paper's comprehensive and robust experimental study lends strong empirical support to its claims. Furthermore, the authors demonstrate a constructive response to critiques, effectively addressing concerns regarding the simplicity of attacks and the depth of analysis. All reviewers have recommended the acceptance of this paper.
Decision: Accept (poster)