Cheating Stereo Matching in Full-scale: Physical Adversarial Attack against Binocular Depth Estimation in Autonomous Driving

TL;DR

This paper introduces a novel physical adversarial attack on stereo depth estimation models in autonomous driving, using textured 3D objects that blend into the environment to deceive binocular vision systems effectively.

Contribution

It presents the first texture-enabled 3D physical adversarial attack for stereo matching, including a new rendering module and merging technique for enhanced stealth and effectiveness.

Findings

PAEs successfully fool stereo models into incorrect depth estimations

The attack maintains visual consistency across different viewpoints

Enhanced stealth through seamless background merging

Abstract

Though deep neural models adopted to realize the perception of autonomous driving have proven vulnerable to adversarial examples, known attacks often leverage 2D patches and target mostly monocular perception. Therefore, the effectiveness of Physical Adversarial Examples (PAEs) on stereo-based binocular depth estimation remains largely unexplored. To this end, we propose the first texture-enabled physical adversarial attack against stereo matching models in the context of autonomous driving. Our method employs a 3D PAE with global camouflage texture rather than a local 2D patch-based one, ensuring both visual consistency and attack effectiveness across different viewpoints of stereo cameras. To cope with the disparity effect of these cameras, we also propose a new 3D stereo matching rendering module that allows the PAE to be aligned with real-world positions and headings in binocular vision. We further propose a novel merging attack that seamlessly blends the target into the environment through fine-grained PAE optimization. It has significantly enhanced stealth and lethality upon existing hiding attacks that fail to get seamlessly merged into the background. Extensive evaluations show that our PAEs can successfully fool the stereo models into producing erroneous depth information.