SABER: Spatially Consistent 3D Universal Adversarial Objects for BEV Detectors

TL;DR

This paper introduces a novel framework for creating universal, non-invasive, and 3D-consistent adversarial objects that can reliably deceive BEV 3D detectors in autonomous driving scenarios, highlighting vulnerabilities in current models.

Contribution

It presents the first method to generate physically plausible, multi-view, and temporal consistent adversarial objects that do not modify target vehicles, advancing robustness evaluation techniques.

Findings

Universal adversarial objects significantly degrade BEV detector performance.

The method maintains attack effectiveness across multiple viewpoints and distances.

It reveals over-reliance of models on contextual cues, exposing robustness weaknesses.

Abstract

Adversarial robustness of BEV 3D object detectors is critical for autonomous driving (AD). Existing invasive attacks require altering the target vehicle itself (e.g. attaching patches), making them unrealistic and impractical for real-world evaluation. While non-invasive attacks that place adversarial objects in the environment are more practical, current methods still lack the multi-view and temporal consistency needed for physically plausible threats. In this paper, we present the first framework for generating universal, non-invasive, and 3D-consistent adversarial objects that expose fundamental vulnerabilities for BEV 3D object detectors. Instead of modifying target vehicles, our method inserts rendered objects into scenes with an occlusion-aware module that enforces physical plausibility across views and time. To maintain attack effectiveness across views and frames, we optimize adversarial object appearance using a BEV spatial feature-guided optimization strategy that attacks the detector's internal representations. Extensive experiments demonstrate that our learned universal adversarial objects can consistently degrade multiple BEV detectors from various viewpoints and distances. More importantly, the new environment-manipulation attack paradigm exposes models' over-reliance on contextual cues and provides a practical pipeline for robustness evaluation in AD systems.