AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Driving
On the map: End-to-end autonomous driving → Adversarial scenarios and safety testing
Abstract (arXiv)
Camera-based object detectors are vulnerable to physical adversarial attacks designed to suppress detections. While adversarial training and input purification offer some protection, they often overfit to specific attack distributions and fail on adaptive adversaries. This paper presents AdROD, an embedded, stochastic ensemble defense software designed for autonomous driving. AdROD employs em low-rank HyperNetworks, which require only 1.6% of the parameter footprint of standard HyperNetworks, to generate diverse detectors at a per-frame rate, making it impractical for attackers to obtain the deployed detectors in time. To further improve adversarial robustness, AdROD incorporates a novel functional diversity mechanism, which couples stochastic weight updates with unique input-space transformations. We design two serving modes of AdROD that strike different trade-offs between robustness and runtime overhead: AdROD-I, a continuous protection mode for maximum resilience that leverages inter-detector disagreement to recover compromised detections, and AdROD-II, an on-demand mode triggered by kinematic discontinuities in object tracking. Through comprehensive evaluation with synthetic benchmarks, physically deployed adversarial patches, and end-to-end safety tests in the OpenCDA co-simulator, AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Adversarial scenarios and safety testing, one of 9 directions in End-to-end autonomous driving. Builds on 32 of its 56 references that are in the map. First posted on arXiv 17 Aug 2026.
Builds on
32 of 56 references.
References · 32
- 2014Microsoft COCO: Common Objects in Contextcited by 17,498
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
- 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
- 2017CARLA: An Open Urban Driving Simulatorcited by 2,431
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2017Countering Adversarial Images using Input Transformationscited by 517
- 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
- 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
- 2014Multiple Object Tracking: A Literature Reviewcited by 165
- 2018Physical Adversarial Examples for Object Detectorscited by 163
- 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
20 more
- 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 85
- 2020DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensemblescited by 73
- 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
- 2020The Translucent Patch: A Physical and Universal Attack on Object Detectorscited by 62
- 2019Towards Adversarially Robust Object Detectioncited by 55
- 2023Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attackcited by 37
- 2023Jedi: Entropy-based Localization and Removal of Adversarial Patchescited by 35
- 2020Block-wise Image Transformation with Secret Key for Adversarially Robust Defensecited by 30
- 2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
- 2022Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systemscited by 27
- 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
- 2022Adversarial Attack and Defense of YOLO Detectors in Autonomous Driving Scenarioscited by 20
- 2024Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perceptioncited by 14
- 2018Defensive Dropout for Hardening Deep Neural Networks under Adversarial Attackscited by 13
- 2019Moving Target Defense for Deep Visual Sensing against Adversarial Examplescited by 7
- 2024Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspectivecited by 6
- 2024Invisible Optical Adversarial Stripes on Traffic Sign against Autonomous Vehiclescited by 5
- 2023Attention-Based Real-Time Defenses for Physical Adversarial Attacks in Vision Applicationscited by 3
- 2022Sardino: Ultra-Fast Dynamic Ensemble for Secure Visual Sensing at Mobile Edgecited by 2
- 2023Efficient Key-Based Adversarial Defense for ImageNet by Using Pre-trained Modelcited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026AD2: Analysis and Detection of Adversarial Threats in Visual Perception for End-to-End Autonomous Driving Systems
- 2025Revisiting Adversarial Perception Attacks and Defense Methods on Autonomous Driving Systems
- 2026ADV-0: Closed-Loop Min-Max Adversarial Training for Long-Tail Robustness in Autonomous Driving
- 2026UniAda: Universal Adaptive Multi-objective Adversarial Attack for End-to-End Autonomous Driving Systems
- 2025PhysPatch: A Physically Realizable and Transferable Adversarial Patch Attack for Multimodal Large Language Models-based Autonomous Driving Systems
- 2024AdvDiffuser: Generating Adversarial Safety-Critical Driving Scenarios via Guided Diffusion
- 2024VCAT: Vulnerability-aware and Curiosity-driven Adversarial Training for Enhancing Autonomous Vehicle Robustness
- 2021Evaluating Adversarial Attacks on Driving Safety in Vision-Based Autonomous Vehicles