Physical Adversarial Attack on Monocular Depth Estimation via Shape-Varying Patches

TL;DR

This paper presents a physics-based adversarial attack method called ASP that uses shape-varying patches to significantly disrupt monocular depth estimation systems, especially in safety-critical scenarios like autonomous driving.

Contribution

It introduces a novel framework with shape-varying patches and a new loss function to extend attack influence beyond patch overlap, improving attack effectiveness on monocular depth estimation.

Findings

Achieves an average depth error of 18 meters on the target car.

Affects over 98% of the target area with a patch covering 1/9 of it.

Demonstrates the effectiveness of shape-varying patches in physical adversarial attacks.

Abstract

Adversarial attacks against monocular depth estimation (MDE) systems pose significant challenges, particularly in safety-critical applications such as autonomous driving. Existing patch-based adversarial attacks for MDE are confined to the vicinity of the patch, making it difficult to affect the entire target. To address this limitation, we propose a physics-based adversarial attack on monocular depth estimation, employing a framework called Attack with Shape-Varying Patches (ASP), aiming to optimize patch content, shape, and position to maximize effectiveness. We introduce various mask shapes, including quadrilateral, rectangular, and circular masks, to enhance the flexibility and efficiency of the attack. Furthermore, we propose a new loss function to extend the influence of the patch beyond the overlapping regions. Experimental results demonstrate that our attack method generates an average depth error of 18 meters on the target car with a patch area of 1/9, affecting over 98\% of the target area.