SpotAttack: Covering Spots on Surface to Attack LiDAR-Based Autonomous Driving Systems

LiDAR significantly contributes to autonomous driving systems (ADSs) through its perception, prediction and decision layers. Recent research has focused on implementing adversarial attack on LiDAR-based ADS by generating perturbed point cloud adversarial samples. However, most state-of-the-art attacks focus on stationary scenarios, making it difficult to apply them in dynamic scenarios with multiframe point clouds. In this article, we introduce SpotAttack, a novel adversarial attack that targets specific areas of a vehicle’s surface using distributed patches. Unlike traditional adversarial mechanism that mislead the object classification through pixel perturbations, our designed spots decrease the reflectivity of LiDAR rays, causing the point clouds in these patches to be obscured. As a result, the 3-D object detection network will produce incorrect pose estimations based on the adversarial point cloud samples. To ensure the effectiveness of SpotAttack in dynamic scenarios, we establish a position matrix for multiobjective optimization and adopt genetic algorithm (GA) to address the nondifferentiable issue in spots generation. We conduct extensive experiments in three typical scenarios, and the results demonstrate that the proposed attack can manipulate LiDAR perception and influence ADS decision making.