Pixel-Optimization-Free Patch Attack on Stereo Depth Estimation

TL;DR

This paper introduces PatchHunter, a novel pixel-optimization-free attack method for stereo depth estimation that is more effective and transferable than existing pixel-level attacks, demonstrated across various datasets and real-world conditions.

Contribution

The paper extends stereo-matching attack frameworks and proposes PatchHunter, a reinforcement learning-based method that generates transferable patch patterns without pixel optimization, improving attack robustness.

Findings

PatchHunter outperforms pixel-level attacks on KITTI dataset.

PatchHunter demonstrates high transferability in real-world scenarios.

The method remains effective under challenging conditions like low lighting.

Abstract

Stereo Depth Estimation (SDE) is essential for scene perception in vision-based systems such as autonomous driving. Prior work shows SDE is vulnerable to pixel-optimization attacks, but these methods are limited to digital, static, and view-specific settings, making them impractical. This raises a central question: how to design deployable, adaptive, and transferable attacks under realistic constraints? We present two contributions to answer it. First, we build a unified framework that extends pixel-optimization attacks to four stereo-matching stages: feature extraction, cost-volume construction, cost aggregation, and disparity regression. Through systematic evaluation across nine SDE models with realistic constraints like photometric consistency, we show existing attacks suffer from poor transferability. Second, we propose PatchHunter, the first pixel-optimization-free attack. PatchHunter casts patch generation as a search in a structured space of visual patterns that disrupt core SDE assumptions, and uses a reinforcement learning policy to discover effective and transferable patterns efficiently. We evaluate PatchHunter on three levels: autonomous driving dataset, high-fidelity simulator, and real-world deployment. On KITTI, PatchHunter outperforms pixel-level attacks in both effectiveness and black-box transferability. Tests in CARLA and on vehicles with industrial-grade stereo cameras confirm robustness to physical variations. Even under challenging conditions such as low lighting, PatchHunter achieves a D1-all error above 0.4, while pixel-level attacks remain near 0.