# Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving

arXiv: https://arxiv.org/abs/2403.17301 · HTML: https://mlsanity.com/paper/2403.17301/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- Builds on 30 of its 44 references that are in the map.
- First posted on arXiv 26 Mar 2024.

## Builds on (most cited first, 30 of 30)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [CARLA: An Open Urban Driving Simulator](https://mlsanity.com/paper/1711.03938/) (2017)
- [Depth Map Prediction from a Single Image using a Multi-Scale Deep Network](https://mlsanity.com/paper/1406.2283/) (2014)
- [Adversarial Patch](https://mlsanity.com/paper/1712.09665/) (2017)
- [Neural 3D Mesh Renderer](https://mlsanity.com/paper/1711.07566/) (2017)
- [Understanding Deep Image Representations by Inverting Them](https://mlsanity.com/paper/1412.0035/) (2014)
- [Deeper Depth Prediction with Fully Convolutional Residual Networks](https://mlsanity.com/paper/1606.00373/) (2016)
- [Fooling automated surveillance cameras: adversarial patches to attack person detection](https://mlsanity.com/paper/1904.08653/) (2019)
- [The Temporal Opportunist: Self-Supervised Multi-Frame Monocular Depth](https://mlsanity.com/paper/2104.14540/) (2021)
- [Learning Depth from Single Monocular Images Using Deep Convolutional Neural Fields](https://mlsanity.com/paper/1502.07411/) (2015)
- [Deep Photo Style Transfer](https://mlsanity.com/paper/1703.07511/) (2017)
- [Self-Supervised Monocular Depth Hints](https://mlsanity.com/paper/1909.09051/) (2019)
- [Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World](https://mlsanity.com/paper/2103.01050/) (2021)
- [TrafficPredict: Trajectory Prediction for Heterogeneous Traffic-Agents](https://mlsanity.com/paper/1811.02146/) (2018)
- [On Success and Simplicity: A Second Look at Transferable Targeted Attacks](https://mlsanity.com/paper/2012.11207/) (2020)
- [FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attack](https://mlsanity.com/paper/2109.07193/) (2021)
- [Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance](https://mlsanity.com/paper/1911.02466/) (2019)
- [Rain rendering for evaluating and improving robustness to bad weather](https://mlsanity.com/paper/2009.03683/) (2020)
- [Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches](https://mlsanity.com/paper/2207.04718/) (2022)
- [DTA: Physical Camouflage Attacks using Differentiable Transformation Network](https://mlsanity.com/paper/2203.09831/) (2022)
- [Targeted Adversarial Perturbations for Monocular Depth Prediction](https://mlsanity.com/paper/2006.08602/) (2020)
- [Physical Adversarial Attack on Vehicle Detector in the Carla Simulator](https://mlsanity.com/paper/2007.16118/) (2020)
- [ACTIVE: Towards Highly Transferable 3D Physical Camouflage for Universal and Robust Vehicle Evasion](https://mlsanity.com/paper/2308.07009/) (2023)
- [Adversarial Patch Attacks on Monocular Depth Estimation Networks](https://mlsanity.com/paper/2010.03072/) (2020)
- [SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examples](https://mlsanity.com/paper/2312.09520/) (2023)
- [Quantization Aware Attack: Enhancing Transferable Adversarial Attacks by Model Quantization](https://mlsanity.com/paper/2305.05875/) (2023)
- [SAAM: Stealthy Adversarial Attack on Monocular Depth Estimation](https://mlsanity.com/paper/2308.03108/) (2023)
- [APARATE: Adaptive Adversarial Patch for CNN-based Monocular Depth Estimation for Autonomous Navigation](https://mlsanity.com/paper/2303.01351/) (2023)
- [Adversarial Attacks on Monocular Pose Estimation](https://mlsanity.com/paper/2207.07032/) (2022)

## Built on by (most cited first, 30 of 32)

- [Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Models](https://mlsanity.com/paper/2404.10335/) (2024)
- [D3: Training-Free AI-Generated Video Detection Using Second-Order Features](https://mlsanity.com/paper/2508.00701/) (2025)
- [Enhancing Targeted Adversarial Attacks on Large Vision-Language Models via Intermediate Projector](https://mlsanity.com/paper/2508.13739/) (2025)
- [ER-LoRA: Effective-Rank Guided Adaptation for Weather-Generalized Depth Estimation](https://mlsanity.com/paper/2509.00665/) (2025)
- [RenderBender: A Survey on Adversarial Attacks Using Differentiable Rendering](https://mlsanity.com/paper/2411.09749/) (2024)
- [BaseBoostDepth: Exploiting Larger Baselines For Self-supervised Monocular Depth Estimation](https://mlsanity.com/paper/2407.20437/) (2024)
- [Camouflaged Object Tracking: A Benchmark](https://mlsanity.com/paper/2408.13877/) (2024)
- [Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insights](https://mlsanity.com/paper/2508.00649/) (2025)
- [Thermally Activated Dual-Modal Adversarial Clothing against AI Surveillance Systems](https://mlsanity.com/paper/2511.09829/) (2025)
- [Toward Robust and Accurate Adversarial Camouflage Generation against Vehicle Detectors](https://mlsanity.com/paper/2411.10029/) (2024)
- [Task-Agnostic Attacks Against Vision Foundation Models](https://mlsanity.com/paper/2503.03842/) (2025)
- [Towards Benchmarking and Assessing the Safety and Robustness of Autonomous Driving on Safety-critical Scenarios](https://mlsanity.com/paper/2503.23708/) (2025)
- [A Few Large Shifts: Layer-Inconsistency Based Minimal Overhead Adversarial Example Detection](https://mlsanity.com/paper/2505.12586/) (2025)
- [PoInit-of-View: Poisoning Initialization of Views Transfers Across Multiple 3D Reconstruction Systems](https://mlsanity.com/paper/2604.16540/) (2026)
- [Physical Adversarial Attack on Monocular Depth Estimation via Shape-Varying Patches](https://mlsanity.com/paper/2407.17312/) (2024)
- [PADetBench: Towards Benchmarking Physical Attacks against Object Detection](https://mlsanity.com/paper/2408.09181/) (2024)
- [Survey on Monocular Metric Depth Estimation](https://mlsanity.com/paper/2501.11841/) (2025)
- [LMDepth: Lightweight Mamba-based Monocular Depth Estimation for Real-World Deployment](https://mlsanity.com/paper/2505.00980/) (2025)
- [BadDepth: Backdoor Attacks Against Monocular Depth Estimation in the Physical World](https://mlsanity.com/paper/2505.16154/) (2025)
- [DepthVanish: Optimizing Adversarial Interval Structures for Stereo-Depth-Invisible Patches](https://mlsanity.com/paper/2506.16690/) (2025)
- [Pixel-Optimization-Free Patch Attack on Stereo Depth Estimation](https://mlsanity.com/paper/2506.17632/) (2025)
- [ComplicitSplat: Downstream Models are Vulnerable to Blackbox Attacks by 3D Gaussian Splat Camouflages](https://mlsanity.com/paper/2508.11854/) (2025)
- [BiTAA: A Bi-Task Adversarial Attack for Object Detection and Depth Estimation via 3D Gaussian Splatting](https://mlsanity.com/paper/2509.19793/) (2025)
- [Attack logics, not outputs: Towards efficient robustification of deep neural networks by falsifying concept-based properties](https://mlsanity.com/paper/2510.03320/) (2025)
- [Cheating Stereo Matching in Full-scale: Physical Adversarial Attack against Binocular Depth Estimation in Autonomous Driving](https://mlsanity.com/paper/2511.14386/) (2025)
- [The 3D Mirage: Probing and Taming 3D Hallucinations](https://mlsanity.com/paper/2512.15423/) (2025)
- [PTC-Depth: Pose-Refined Monocular Depth Estimation with Temporal Consistency](https://mlsanity.com/paper/2604.01791/) (2026)
- [Sphere-Depth: A Benchmark for Depth Estimation Methods with Varying Spherical Camera Orientations](https://mlsanity.com/paper/2604.23432/) (2026)
- [Adversarial Flow Matching for Imperceptible Attacks on End-to-End Autonomous Driving](https://mlsanity.com/paper/2605.00880/) (2026)
- [Unleashing the Representational Power of Fourier Shapes for Attacking Infrared Object Detection](https://mlsanity.com/paper/2605.17822/) (2026)

## Abstract (arXiv)

Deep learning-based monocular depth estimation (MDE), extensively applied in autonomous driving, is known to be vulnerable to adversarial attacks. Previous physical attacks against MDE models rely on 2D adversarial patches, so they only affect a small, localized region in the MDE map but fail under various viewpoints. To address these limitations, we propose 3D Depth Fool (3D2Fool), the first 3D texture-based adversarial attack against MDE models. 3D2Fool is specifically optimized to generate 3D adversarial textures agnostic to model types of vehicles and to have improved robustness in bad weather conditions, such as rain and fog. Experimental results validate the superior performance of our 3D2Fool across various scenarios, including vehicles, MDE models, weather conditions, and viewpoints. Real-world experiments with printed 3D textures on physical vehicle models further demonstrate that our 3D2Fool can cause an MDE error of over 10 meters.