Shadow-Catcher: Looking Into Shadows to Detect Ghost Objects in Autonomous Vehicle 3D Sensing

TL;DR

Shadow-Catcher introduces a novel LiDAR shadow-based validation method to detect and prevent ghost object attacks in autonomous vehicle 3D sensing, effectively identifying both large and small spoofed objects with high accuracy and real-time performance.

Contribution

It proposes a new shadow-based invariant for validating 3D objects and develops an end-to-end prototype that detects ghost objects in real-time, addressing limitations of prior defenses.

Findings

Achieves over 94% accuracy in detecting ghost objects across various classes.

Remains robust against strong invalidation attacks targeting the defense system.

Processes objects in 3D point clouds with a speedup of 2.17x over previous methods.

Abstract

LiDAR-driven 3D sensing allows new generations of vehicles to achieve advanced levels of situation awareness. However, recent works have demonstrated that physical adversaries can spoof LiDAR return signals and deceive 3D object detectors to erroneously detect "ghost" objects. Existing defenses are either impractical or focus only on vehicles. Unfortunately, it is easier to spoof smaller objects such as pedestrians and cyclists, but harder to defend against and can have worse safety implications. To address this gap, we introduce Shadow-Catcher, a set of new techniques embodied in an end-to-end prototype to detect both large and small ghost object attacks on 3D detectors. We characterize a new semantically meaningful physical invariant (3D shadows) which Shadow-Catcher leverages for validating objects. Our evaluation on the KITTI dataset shows that Shadow-Catcher consistently achieves more than 94% accuracy in identifying anomalous shadows for vehicles, pedestrians, and cyclists, while it remains robust to a novel class of strong "invalidation" attacks targeting the defense system. Shadow-Catcher can achieve real-time detection, requiring only between 0.003s-0.021s on average to process an object in a 3D point cloud on commodity hardware and achieves a 2.17x speedup compared to prior work