Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Driving

TL;DR

AdvAD introduces a transfer-based physical adversarial patch method that attacks multiple object detection models in autonomous driving, improving transferability and robustness in real-world scenarios.

Contribution

The paper presents AdvAD, a novel unified framework for creating physical adversarial patches that effectively transfer across different object detection models in autonomous driving.

Findings

AdvAD outperforms state-of-the-art attacks in digital and real-world tests.

The method enhances transferability of adversarial patches across multiple models.

Physical variations and transformations are effectively mitigated by the proposed approach.

Abstract

Deep learning drives major advances in autonomous driving (AD), where object detectors are central to perception. However, adversarial attacks pose significant threats to the reliability and safety of these systems, with physical adversarial patches representing a particularly potent form of attack. Physical adversarial patch attacks pose severe risks but are usually crafted for a single model, yielding poor transferability to unseen detectors. We propose AdvAD, a transfer-based physical attack against object detection in autonomous driving. Instead of targeting a specific detector, AdvAD optimizes adversarial patches over multiple detection models in a unified framework, encouraging the learned perturbations to capture shared vulnerabilities across architectures. The optimization process adaptively balances model contributions and enforces robustness to physical variations. It further employs data augmentation and geometric transformations to maintain patch effectiveness under diverse physical conditions. Experiments in both digital and real-world settings show that AdvAD consistently outperforms state-of-the-art (SOTA) attacks in performance and transferability.