mlsanityData to 7 Oct 2026

Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks

arXiv 2106.09249 ↗First posted 17 Jun 2021cs.CR cs.CV cs.LGcited by 101

On the map: End-to-end autonomous driving → Adversarial scenarios and safety testing

Abstract (arXiv)

In Autonomous Driving (AD) systems, perception is both security and safety critical. Despite various prior studies on its security issues, all of them only consider attacks on camera- or LiDAR-based AD perception alone. However, production AD systems today predominantly adopt a Multi-Sensor Fusion (MSF) based design, which in principle can be more robust against these attacks under the assumption that not all fusion sources are (or can be) attacked at the same time. In this paper, we present the first study of security issues of MSF-based perception in AD systems. We directly challenge the basic MSF design assumption above by exploring the possibility of attacking all fusion sources simultaneously. This allows us for the first time to understand how much security guarantee MSF can fundamentally provide as a general defense strategy for AD perception. We formulate the attack as an optimization problem to generate a physically-realizable, adversarial 3D-printed object that misleads an AD system to fail in detecting it and thus crash into it. We propose a novel attack pipeline that addresses two main design challenges: (1) non-differentiable target camera and LiDAR sensing systems, and (2) non-differentiable cell-level aggregated features popularly used in LiDAR-based AD perception. We evaluate our attack on MSF included in representative open-source industry-grade AD systems in real-world driving scenarios. Our results show that the attack achieves over 90% success rate across different object types and MSF. Our attack is also found stealthy, robust to victim positions, transferable across MSF algorithms, and physical-world realizable after being 3D-printed and captured by LiDAR and camera devices. To concretely assess the end-to-end safety impact, we further perform simulation evaluation and show that it can cause a 100% vehicle collision rate for an industry-grade AD system.

Key facts. Cited by 101 papers in the map (data through 7 Oct 2026). Placed in Adversarial scenarios and safety testing, one of 9 directions in End-to-end autonomous driving. Builds on 64 of its 130 references that are in the map. First posted on arXiv 17 Jun 2021.

Builds on

64 of 130 references.

References · 64

  1. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  6. 2018PointPillars: Fast Encoders for Object Detection from Point Cloudscited by 1,707
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  8. 2017VoxelNet: End-to-End Learning for Point Cloud Based 3D Object Detectioncited by 1,323
  9. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  10. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  11. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  12. 2016Multi-View 3D Object Detection Network for Autonomous Drivingcited by 721
38 more
  1. 2019Adversarial Training for Free!cited by 638
  2. 2019Deep Learning for 3D Point Clouds: A Surveycited by 557
  3. 2018Object Detection with Deep Learning: A Reviewcited by 524
  4. 2017Adversarial Patchcited by 514
  5. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  6. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  7. 2017Neural 3D Mesh Renderercited by 437
  8. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  9. 2019A Survey of Autonomous Driving: Common Practices and Emerging Technologiescited by 373
  10. 2019PIXOR: Real-time 3D Object Detection from Point Cloudscited by 358
  11. 2017Joint 3D Proposal Generation and Object Detection from View Aggregationcited by 325
  12. 2017DeepXplore: Automated Whitebox Testing of Deep Learning Systemscited by 307
  13. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
  14. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  15. 2020Deep Continuous Fusion for Multi-Sensor 3D Object Detectioncited by 263
  16. 2018Generating Adversarial Examples with Adversarial Networkscited by 256
  17. 2017DeepTest: Automated Testing of Deep-Neural-Network-driven Autonomous Carscited by 249
  18. 2020Multi-Task Multi-Sensor Fusion for 3D Object Detectioncited by 203
  19. 2016A study of the effect of JPG compression on adversarial imagescited by 196
  20. 2018Spatially Transformed Adversarial Examplescited by 195
  21. 2017PointFusion: Deep Sensor Fusion for 3D Bounding Box Estimationcited by 170
  22. 2018Physical Adversarial Examples for Object Detectorscited by 163
  23. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  24. 2020Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuningcited by 152
  25. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 151
  26. 2020Randomized Smoothing of All Shapes and Sizescited by 146
  27. 2018Generating 3D Adversarial Point Cloudscited by 144
  28. 2019Accurate Monocular Object Detection via Color-Embedded 3D Reconstruction for Autonomous Drivingcited by 137
  29. 2020SoK: Certified Robustness for Deep Neural Networkscited by 100
  30. 2020Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasurescited by 95
  31. 2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
  32. 2018GenAttack: Practical Black-box Attacks with Gradient-Free Optimizationcited by 82
  33. 2018Interpretable Deep Learning under Firecited by 74
  34. 2016Vote3Deep: Fast Object Detection in 3D Point Clouds Using Efficient Convolutional Neural Networkscited by 72
  35. 2019Adversarial camera stickers: A physical camera-based attack on deep learning systemscited by 69
  36. 2019Towards Adversarially Robust Object Detectioncited by 55
  37. 2017MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examplescited by 46
  38. 2018Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentationcited by 40

50 most cited of 64 All 64 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 5; 2022: 14; 2023: 29; 2024: 18; 2025: 20; 2026: 15.

101 papers.

Sort:

By area:

  1. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  2. 20223D Object Detection for Autonomous Driving: A Comprehensive Surveycited by 132
  3. 2023Robo3D: Towards Robust and Reliable 3D Perception against Corruptionscited by 128
  4. 2023Robust Classification via a Single Diffusion Modelcited by 79
  5. 2022SafeBench: A Benchmarking Platform for Safety Evaluation of Autonomous Vehiclescited by 65
  6. 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 58
  7. 2022Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patchescited by 57
  8. 2022Shape-invariant 3D Adversarial Point Cloudscited by 49
  9. 20213D-VField: Adversarial Augmentation of Point Clouds for Domain Generalization in 3D Object Detectioncited by 43
  10. 2022Infrared Invisible Clothing:Hiding from Infrared Detectors at Multiple Angles in Real Worldcited by 42
  11. 2023RoboBEV: Towards Robust Bird's Eye View Perception under Corruptionscited by 42
  12. 2024Benchmarking and Improving Bird's Eye View Perception Robustness in Autonomous Drivingcited by 39
38 more
  1. 2023Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attackcited by 37
  2. 2023DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purificationcited by 36
  3. 2025Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attackscited by 32
  4. 2022SoK: On the Semantic AI Security in Autonomous Drivingcited by 22
  5. 2023TPatch: A Triggered Physical Adversarial Patchcited by 22
  6. 2023DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothingcited by 20
  7. 2023Adversarial Training of Self-supervised Monocular Depth Estimation against Physical-World Attackscited by 17
  8. 2021roadscene2vec: A Tool for Extracting and Embedding Road Scene-Graphscited by 15
  9. 2023On the Adversarial Robustness of Camera-based 3D Object Detectioncited by 15
  10. 2023SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examplescited by 15
  11. 2021Learning to Learn Transferable Attackcited by 13
  12. 2022Illusory Attacks: Information-Theoretic Detectability Matters in Adversarial Attackscited by 12
  13. 2025MIP against Agent: Malicious Image Patches Hijacking Multimodal OS Agentscited by 12
  14. 2023Fusion is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detectioncited by 11
  15. 2023On Data Fabrication in Collaborative Vehicular Perception: Attacks and Countermeasurescited by 11
  16. 2022TPC: Transformation-Specific Smoothing for Point Cloud Modelscited by 10
  17. 2022CARE: Certifiably Robust Learning with Reasoning via Variational Inferencecited by 10
  18. 2022PointCAT: Contrastive Adversarial Training for Robust Point Cloud Recognitioncited by 10
  19. 2023Adv3D: Generating 3D Adversarial Examples for 3D Object Detection in Driving Scenarios with NeRFcited by 10
  20. 2023LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategiescited by 9
  21. 2023Security Considerations in AI-Robotics: A Survey of Current Methods, Challenges, and Opportunitiescited by 9
  22. 2024COLEP: Certifiably Robust Learning-Reasoning Conformal Prediction via Probabilistic Circuitscited by 9
  23. 2024Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defencescited by 9
  24. 2024Radar and Camera Fusion for Object Detection and Tracking: A Comprehensive Surveycited by 9
  25. 2021Detecting Multi-Sensor Fusion Errors in Advanced Driver-Assistance Systemscited by 8
  26. 2023BELT: Old-School Backdoor Attacks can Evade the State-of-the-Art Defense with Backdoor Exclusivity Liftingcited by 7
  27. 2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
  28. 2024Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspectivecited by 6
  29. 2024Enhancing LLM-based Autonomous Driving Agents to Mitigate Perception Attackscited by 6
  30. 2022Using 3D Shadows to Detect Object Hiding Attacks on Autonomous Vehicle Perceptioncited by 5
  31. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  32. 2024ControlLoc: Physical-World Hijacking Attack on Visual Perception in Autonomous Drivingcited by 5
  33. 2024Self-supervised Adversarial Training of Monocular Depth Estimation against Physical-World Attackscited by 5
  34. 2024Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehiclescited by 5
  35. 20233D Adversarial Augmentations for Robust Out-of-Domain Predictionscited by 4
  36. 2023Intriguing Properties of Diffusion Models: An Empirical Study of the Natural Attack Capability in Text-to-Image Generative Modelscited by 4
  37. 2021On Adversarial Robustness of Point Cloud Semantic Segmentationcited by 3
  38. 2022Sensor Data Validation and Driving Safety in Autonomous Driving Systemscited by 3

50 most cited of 101 All 101 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2021Security Analysis of Camera-LiDAR Fusion Against Black-Box Attacks on Autonomous Vehicles
  2. 2026AD2: Analysis and Detection of Adversarial Threats in Visual Perception for End-to-End Autonomous Driving Systems
  3. 2026Comparative Analysis of Patch Attack on VLM-Based Autonomous Driving Architectures
  4. 2025Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems
  5. 2024Optical Lens Attack on Monocular Depth Estimation for Autonomous Driving
  6. 2026Understanding Adversarial Transferability in Vision-Language Models for Autonomous Driving: A Cross-Architecture Analysis
  7. 2026NutVLM: A Self-Adaptive Defense Framework against Full-Dimension Attacks for Vision Language Models in Autonomous Driving
  8. 2025Guided Diffusion-based Generation of Adversarial Objects for Real-World Monocular Depth Estimation Attacks