针对激光雷达感知算法的黑盒攻击模型与仿真

Black-box Attack Model and Simulation for LiDAR Perception Algorithms

摘要:

为了验证自动驾驶中基于激光雷达感知算法面对攻击的脆弱性，提出了一种使用基于点云上采样算法PC2-PU并配合随机下采样来控制攻击点的数量的黑盒攻击模型，这种攻击能够减少因为数据集本身的缺陷而导致的最终结果出现偏差的情况出现，所提出的攻击模型包括攻击点的数量、位置和高度三个主要因素，通过实验来验证这些因素对攻击结果的影响程度，实验中使用了四种不同类型的感知模型来证明我们提出的攻击的有效性；结果表明，即使只有20个攻击点时，在部分区间位置内的攻击成功率超过了90%，随着攻击点数的增加，在不同位置的攻击成功率均在不断提高；在百度Apollo平台中测试了该攻击对决策层产生的影响。

Abstract:

To verify the vulnerability of LiDAR-based perception algorithms in autonomous driving when facing attacks, a black-box attack model is proposed. This model uses the PC2-PU point clouds upsampling algorithm in combination with random downsampling to control the number of attack points. This attack can reduce the occurrence of biases in the results caused by inherent flaws in the dataset. The proposed attack model includes three main factors: the number, location, and height of attack points. Experiments are conducted to verify the impact of these factors on the attack outcomes. Four dif-ferent types of perception models are used in the experiments to demonstrate the effectiveness of the proposed attack. The results show that even with only 20 attack points, the attack success rate exceeds 90% in some interval positions. As the number of attack points increases, the attack success rate continues to improve at different positions. The impact of this attack on the decision-making layer is also tested on the Baidu Apollo platform.