# ConvNet-Generated Adversarial Perturbations for Evaluating 3D Object Detection Robustness

## TL;DR

This paper introduces a new method using a ConvNet to generate subtle 3D point cloud perturbations that significantly reduce object detection accuracy, especially for small objects like pedestrians and cyclists.

## Contribution

The key novelty is training a ConvNet to generate adversarial perturbations for 3D object detection, enabling fast, gradient-free robustness evaluation during inference.

## Key findings

- Adversarial perturbations degrade 3D object detection by 8–24% on KITTI and NuScenes datasets.
- Smaller objects like pedestrians and cyclists are 3x more vulnerable to adversarial attacks than larger vehicles.
- Perturbations remain within sensor error margins but still cause significant detection failures.

## Abstract

What are the main findings?
Our adversarial Convolutional Neural Network (ConvNet) generates imperceptible perturbations that degrade 3D object detection by 8–24% across KITTI and NuScenes datasets.Smaller objects (pedestrians, cyclists) show 3x higher vulnerability to adversarial attacks compared to larger vehicles.

Our adversarial Convolutional Neural Network (ConvNet) generates imperceptible perturbations that degrade 3D object detection by 8–24% across KITTI and NuScenes datasets.

Smaller objects (pedestrians, cyclists) show 3x higher vulnerability to adversarial attacks compared to larger vehicles.

What is the implication of the main finding?
Current state-of-the-art 3D detection systems used in autonomous vehicles are vulnerable to subtle adversarial perturbations within sensor noise margins.Safety-critical applications require robust defense mechanisms, especially for protecting vulnerable road users where detection failures pose the greatest risk.

Current state-of-the-art 3D detection systems used in autonomous vehicles are vulnerable to subtle adversarial perturbations within sensor noise margins.

Safety-critical applications require robust defense mechanisms, especially for protecting vulnerable road users where detection failures pose the greatest risk.

This paper presents a novel adversarial Convolutional Neural Network (ConvNet) method for generating adversarial perturbations in 3D point clouds, enabling gradient-free robustness evaluation of object detection systems at inference time. Unlike existing iterative gradient methods, our approach embeds the ConvNet directly into the detection pipeline at the voxel feature level. The ConvNet is trained to maximize detection loss while maintaining perturbations within sensor error bounds through multi-component loss constraints (intensity, bias, and imbalance terms). Evaluation on a Sparsely Embedded Convolutional Detection (SECOND) detector with the KITTI dataset shows 8% overall mean Average Precision (mAP) degradation, while CenterPoint on NuScenes exhibits 24% weighted mAP reduction across 10 object classes. Analysis reveals an inverse relationship between object size and adversarial vulnerability: smaller objects (pedestrians: 13%, cyclists: 14%) show higher vulnerability compared to larger vehicles (cars: 0.2%) on KITTI, with similar patterns on NuScenes, where barriers (68%) and pedestrians (32%) are most affected. Despite perturbations remaining within typical sensor error margins (mean L2 norm of 0.09% for KITTI, 0.05% for NuScenes, corresponding to 0.9–2.6 cm at typical urban distances), substantial detection failures occur. The key novelty is training a ConvNet to learn effective adversarial perturbations during a one-time training phase and then using the trained network for gradient-free robustness evaluation during inference, requiring only a forward pass through the ConvNet (1.2–2.0 ms overhead) instead of iterative gradient computation, making continuous vulnerability monitoring practical for autonomous driving safety assessment.