Towards Powerful and Practical Patch Attacks for 2D Object Detection in Autonomous Driving

TL;DR

This paper introduces P3A, a novel patch attack framework targeting 2D object detection in autonomous driving, emphasizing high-resolution datasets and practical success metrics to improve attack transferability and effectiveness.

Contribution

The paper proposes P3A with a new PASR metric, a localization-confidence suppression loss, and probabilistic scale-preserving padding to enhance black-box attack transferability in high-resolution autonomous driving datasets.

Findings

P3A outperforms existing attacks on unseen models.

P3A achieves higher success rates under practical IoU-based metrics.

The framework maintains effectiveness on high-resolution datasets.

Abstract

Learning-based autonomous driving systems remain critically vulnerable to adversarial patches, posing serious safety and security risks in their real-world deployment. Black-box attacks, notable for their high attack success rate without model knowledge, are especially concerning, with their transferability extensively studied to reduce computational costs compared to query-based attacks. Previous transferability-based black-box attacks typically adopt mean Average Precision (mAP) as the evaluation metric and design training loss accordingly. However, due to the presence of multiple detected bounding boxes and the relatively lenient Intersection over Union (IoU) thresholds, the attack effectiveness of these approaches is often overestimated, resulting in reduced success rates in practical attacking scenarios. Furthermore, patches trained on low-resolution data often fail to maintain effectiveness on high-resolution images, limiting their transferability to autonomous driving datasets. To fill this gap, we propose P$^3$A, a Powerful and Practical Patch Attack framework for 2D object detection in autonomous driving, specifically optimized for high-resolution datasets. First, we introduce a novel metric, Practical Attack Success Rate (PASR), to more accurately quantify attack effectiveness with greater relevance for pedestrian safety. Second, we present a tailored Localization-Confidence Suppression Loss (LCSL) to improve attack transferability under PASR. Finally, to maintain the transferability for high-resolution datasets, we further incorporate the Probabilistic Scale-Preserving Padding (PSPP) into the patch attack pipeline as a data preprocessing step. Extensive experiments show that P$^3$A outperforms state-of-the-art attacks on unseen models and unseen high-resolution datasets, both under the proposed practical IoU-based evaluation metric and the previous mAP-based metrics.